{"id":"CVE-2026-43345","aliases":["BELL-CVE-2026-43345","DEBIAN-CVE-2026-43345","EUVD-2026-28629","GHSA-7657-q549-6g59","OESA-2026-2581","OESA-2026-2582","ROOT-OS-UBUNTU-2404-CVE-2026-43345","SUSE-SU-2026:22433-1","SUSE-SU-2026:22436-1","SUSE-SU-2026:22458-1","SUSE-SU-2026:22460-1","SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:2722-1","SUSE-SU-2026:2799-1","UBUNTU-CVE-2026-43345","USN-8567-1","USN-8574-1","USN-8574-2","USN-8574-3","USN-8595-1","USN-8595-2","USN-8595-3","USN-8596-1","USN-8606-1","USN-8607-1","USN-8608-1","USN-8609-1","USN-8619-1","USN-8665-1","openSUSE-SU-2026:21388-1"],"status":"published","title":"net: ipa: fix event ring index not programmed for IPA v5.0+","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00353,"percentile":0.29218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-05-08T13:39:31Z","modified":"2026-11-06T16:17:47Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.85-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.6.136","6.12.83","6.18.24","6.19.14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.85-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.19.14-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1061.64~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1063.71~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","fixed_in":["6.8.0-1062.69~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1064.72~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-136.136~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1061.62~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-136.136.2~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1059.62~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1058.61~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-136.136~22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1056.57~22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-136.136"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1061.64"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1063.71"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","fixed_in":["6.8.0-1062.69"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1064.72"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1059.67"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1046.50"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1061.62"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-136.136.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1059.62"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1059.62.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1030.31"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1058.61"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1061.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-vmware","fixed_in":["6.8.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1033.34"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","fixed_in":["6.8.0-1028.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2050.52"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1056.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","fixed_in":["6.8.0-1061.64+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","fixed_in":["6.8.0-1063.71+fips2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-136.136+fips2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","fixed_in":["6.8.0-1064.72+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","fixed_in":["7.0.0-1006.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.81-r0"},{"fixed":"6.12.85-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.6.136"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.83"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.24"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.14"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.14-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.1.14.152.oe2403sp1"}]}],"bundled":101},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.3.14.145.oe2403sp3"}]}],"bundled":150},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1.21.25"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1.21.25"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":71},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1.150700.17.37.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.63.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1057.60~22.04.1","6.8.0-1060.63~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1","6.8.0-1059.65~22.04.1","6.8.0-1062.69~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1062.69~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1","6.8.0-1058.65~22.04.1","6.8.0-1061.68~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1063.69~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.62~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1","6.8.0-1051.51~22.04.1","6.8.0-1052.52~22.04.1","6.8.0-1055.56~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1060.61~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136.2~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1","6.8.0-110.110.1~22.04.1","6.8.0-111.111.1~22.04.1","6.8.0-117.117.1~22.04.1","6.8.0-134.134.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1058.61~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.61~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1","6.8.0-1049.50~22.04.1","6.8.0-1050.51~22.04.1","6.8.0-1052.53~22.04.1","6.8.0-1054.55~22.04.1","6.8.0-1057.58~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136~22.04.3"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1056.57~22.04.2"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2","6.8.1-1047.48~22.04.1","6.8.1-1048.49~22.04.1","6.8.1-1051.52~22.04.1","6.8.1-1052.53~22.04.1","6.8.1-1055.56~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107","6.8.0-110.110","6.8.0-111.111","6.8.0-117.117","6.8.0-124.124","6.8.0-134.134"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1055.58","6.8.0-1057.60","6.8.0-1060.63"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58","6.8.0-1054.60","6.8.0-1056.62","6.8.0-1058.64","6.8.0-1059.65","6.8.0-1062.69"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1062.69"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60","6.8.0-1058.65","6.8.0-1061.68"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1060.63","6.8.0-1063.69"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1","6.17.0-1009.9~24.04.3","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1016.17~24.04.1","6.17.0-1018.19~24.04.1","6.17.0-1020.22~24.04.1","6.17.0-1021.24~24.04.1","6.17.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.67"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54","6.8.0-1050.56","6.8.0-1051.57","6.8.0-1054.60","6.8.0-1055.61","6.8.0-1058.64"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.50"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1037.40","6.8.0-1038.41","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1045.48"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14~24.04.1","6.17.0-19.19~24.04.2","6.17.0-20.20~24.04.1","6.17.0-22.22~24.04.1","6.17.0-23.23~24.04.1","6.17.0-29.29~24.04.1","6.17.0-35.35~24.04.1","6.17.0-40.40~24.04.1","6.17.0-41.41~24.04.1","6.17.0-42.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.62"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50","6.8.0-1051.51","6.8.0-1052.52","6.8.0-1055.56","6.8.0-1057.58","6.8.0-1060.61"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136.2"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1","6.8.0-110.110.1","6.8.0-111.111.1","6.8.0-117.117.1","6.8.0-134.134.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14","6.17.0-1018.18","6.17.0-1021.21","6.17.0-1026.26","6.17.0-1029.29","6.17.0-1031.31","6.17.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1","6.8.0-1051.54.1","6.8.0-1052.55.1","6.8.0-1054.57.1","6.8.0-1055.58.1","6.8.0-1058.61.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1030.31"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1017.17","6.17.0-1020.20","6.17.0-1023.23","6.17.0-1024.24","6.17.0-1025.25","6.17.0-1028.28","6.17.0-1030.30","6.17.0-1032.32","6.17.0-1033.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.61"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48","6.8.0-1049.50","6.8.0-1050.51","6.8.0-1052.53","6.8.0-1054.55","6.8.0-1057.58"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.1","6.17.0-1014.14~24.04.1","6.17.0-1016.16~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1019.19~24.04.3","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.65"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57","6.8.0-1056.60","6.8.0-1057.61","6.8.0-1060.64"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1008.8"}]}],"versions":["6.8.0-1005.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.34"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1032.33"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.33"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1026.30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2050.52"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42","6.8.0-2042.43","6.8.0-2043.44","6.8.0-2045.46","6.8.0-2046.47","6.8.0-2049.50"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1056.57"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47","6.8.1-1047.48","6.8.1-1048.49","6.8.1-1051.52","6.8.1-1052.53","6.8.1-1055.56"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1055.58+fips1","6.8.0-1057.60+fips1","6.8.0-1060.63+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71+fips2"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1","6.8.0-1053.59+fips1","6.8.0-1054.60+fips1","6.8.0-1059.65+fips1","6.8.0-1062.69+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136+fips2"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1","6.8.0-110.110+fips2","6.8.0-111.111+fips1","6.8.0-116.116+fips1","6.8.0-124.124+fips1","6.8.0-134.134+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1054.57+fips1","6.8.0-1055.58+fips1","6.8.0-1058.61+fips1","6.8.0-1060.63+fips1","6.8.0-1063.69+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14","6.17.0-19.19","6.17.0-20.20","6.17.0-22.22","6.17.0-23.23","6.17.0-29.29","6.17.0-35.35","6.17.0-40.40"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1016.17","6.17.0-1018.19","6.17.0-1020.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1016.16","6.17.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1014.14","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7","6.17.0-1008.9","6.17.0-1009.10","6.17.0-1010.11","6.17.0-1011.12","6.17.0-1013.15","6.17.0-1014.16","6.17.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1","6.17.0-14.14.1","6.17.0-19.19.1","6.17.0-20.20.1","6.17.0-22.22.1","6.17.0-23.23.1","6.17.0-29.29.1","6.17.0-35.35.1","6.17.0-40.40.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1006.6"}]}],"versions":["7.0.0-1005.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1063.69~22.04.1"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1056.57~22.04.2"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2","6.8.1-1047.48~22.04.1","6.8.1-1048.49~22.04.1","6.8.1-1051.52~22.04.1","6.8.1-1052.53~22.04.1","6.8.1-1055.56~22.04.1"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107","6.8.0-110.110","6.8.0-111.111","6.8.0-117.117","6.8.0-124.124","6.8.0-134.134"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1060.63","6.8.0-1063.69"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.67"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54","6.8.0-1050.56","6.8.0-1051.57","6.8.0-1054.60","6.8.0-1055.61","6.8.0-1058.64"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1046.50"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1037.40","6.8.0-1038.41","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1045.48"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1056.57"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47","6.8.1-1047.48","6.8.1-1048.49","6.8.1-1051.52","6.8.1-1052.53","6.8.1-1055.56"],"bundled":891},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1064.72+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1054.57+fips1","6.8.0-1055.58+fips1","6.8.0-1058.61+fips1","6.8.0-1060.63+fips1","6.8.0-1063.69+fips1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136.2~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1","6.8.0-110.110.1~22.04.1","6.8.0-111.111.1~22.04.1","6.8.0-117.117.1~22.04.1","6.8.0-134.134.1~22.04.1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136.2"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1","6.8.0-110.110.1","6.8.0-111.111.1","6.8.0-117.117.1","6.8.0-134.134.1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.61"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48","6.8.0-1049.50","6.8.0-1050.51","6.8.0-1052.53","6.8.0-1054.55","6.8.0-1057.58"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136+fips2"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1","6.8.0-110.110+fips2","6.8.0-111.111+fips1","6.8.0-116.116+fips1","6.8.0-124.124+fips1","6.8.0-134.134+fips1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.62~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1","6.8.0-1051.51~22.04.1","6.8.0-1052.52~22.04.1","6.8.0-1055.56~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1060.61~22.04.1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.62"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50","6.8.0-1051.51","6.8.0-1052.52","6.8.0-1055.56","6.8.0-1057.58","6.8.0-1060.61"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1030.31"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1033.34"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1032.33"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.61~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1","6.8.0-1049.50~22.04.1","6.8.0-1050.51~22.04.1","6.8.0-1052.53~22.04.1","6.8.0-1054.55~22.04.1","6.8.0-1057.58~22.04.1"],"bundled":912},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1055.58","6.8.0-1057.60","6.8.0-1060.63"],"bundled":912},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1057.60~22.04.1","6.8.0-1060.63~22.04.1"],"bundled":912},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.64+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1055.58+fips1","6.8.0-1057.60+fips1","6.8.0-1060.63+fips1"],"bundled":912},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1058.61~22.04.1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.62.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1","6.8.0-1051.54.1","6.8.0-1052.55.1","6.8.0-1054.57.1","6.8.0-1055.58.1","6.8.0-1058.61.1"],"bundled":913},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1","6.8.0-1059.65~22.04.1","6.8.0-1062.69~22.04.1"],"bundled":1210},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58","6.8.0-1054.60","6.8.0-1056.62","6.8.0-1058.64","6.8.0-1059.65","6.8.0-1062.69"],"bundled":1210},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1062.69"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60","6.8.0-1058.65","6.8.0-1061.68"],"bundled":1205},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1063.71+fips2"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1","6.8.0-1053.59+fips1","6.8.0-1054.60+fips1","6.8.0-1059.65+fips1","6.8.0-1062.69+fips1"],"bundled":914},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1062.69~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1","6.8.0-1058.65~22.04.1","6.8.0-1061.68~22.04.1"],"bundled":1206},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-136.136~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1"],"bundled":1209},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1061.65"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57","6.8.0-1056.60","6.8.0-1057.61","6.8.0-1060.64"],"bundled":912},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2050.52"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42","6.8.0-2042.43","6.8.0-2043.44","6.8.0-2045.46","6.8.0-2046.47","6.8.0-2049.50"],"bundled":912},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/ae8343a19ccb051d519dbb3a9082ddea9f0551d3","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/2bf18b643c4656413f7cfd5615af60a6b4e261da","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/2d2dc166d55148cfcf8ae67b415f8d6d110e6fca","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/34c988bb04cbdf093d2134e179433da49ffcd044","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/56007972c0b1e783ca714d6f1f4d6e66e531d21f","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43345","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7657-q549-6g59"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-43345","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43345.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43345","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71112","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71202","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31429","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31430","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43503","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46190","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622433-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248235","tags":["report"]},{"url":"https://bugzilla.suse.com/1255416","tags":["report"]},{"url":"https://bugzilla.suse.com/1256668","tags":["report"]},{"url":"https://bugzilla.suse.com/1258538","tags":["report"]},{"url":"https://bugzilla.suse.com/1260502","tags":["report"]},{"url":"https://bugzilla.suse.com/1260584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261256","tags":["report"]},{"url":"https://bugzilla.suse.com/1261619","tags":["report"]},{"url":"https://bugzilla.suse.com/1261791","tags":["report"]},{"url":"https://bugzilla.suse.com/1262085","tags":["report"]},{"url":"https://bugzilla.suse.com/1262392","tags":["report"]},{"url":"https://bugzilla.suse.com/1262606","tags":["report"]},{"url":"https://bugzilla.suse.com/1262615","tags":["report"]},{"url":"https://bugzilla.suse.com/1262617","tags":["report"]},{"url":"https://bugzilla.suse.com/1262619","tags":["report"]},{"url":"https://bugzilla.suse.com/1262620","tags":["report"]},{"url":"https://bugzilla.suse.com/1262622","tags":["report"]},{"url":"https://bugzilla.suse.com/1262624","tags":["report"]},{"url":"https://bugzilla.suse.com/1262634","tags":["report"]},{"url":"https://bugzilla.suse.com/1262649","tags":["report"]},{"url":"https://bugzilla.suse.com/1262656","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1262668","tags":["report"]},{"url":"https://bugzilla.suse.com/1262674","tags":["report"]},{"url":"https://bugzilla.suse.com/1262748","tags":["report"]},{"url":"https://bugzilla.suse.com/1262755","tags":["report"]},{"url":"https://bugzilla.suse.com/1262798","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263006","tags":["report"]},{"url":"https://bugzilla.suse.com/1263068","tags":["report"]},{"url":"https://bugzilla.suse.com/1263115","tags":["report"]},{"url":"https://bugzilla.suse.com/1263123","tags":["report"]},{"url":"https://bugzilla.suse.com/1263137","tags":["report"]},{"url":"https://bugzilla.suse.com/1263143","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263178","tags":["report"]},{"url":"https://bugzilla.suse.com/1263319","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263563","tags":["report"]},{"url":"https://bugzilla.suse.com/1263568","tags":["report"]},{"url":"https://bugzilla.suse.com/1263578","tags":["report"]},{"url":"https://bugzilla.suse.com/1263724","tags":["report"]},{"url":"https://bugzilla.suse.com/1263769","tags":["report"]},{"url":"https://bugzilla.suse.com/1263774","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263879","tags":["report"]},{"url":"https://bugzilla.suse.com/1263880","tags":["report"]},{"url":"https://bugzilla.suse.com/1263883","tags":["report"]},{"url":"https://bugzilla.suse.com/1263930","tags":["report"]},{"url":"https://bugzilla.suse.com/1263932","tags":["report"]},{"url":"https://bugzilla.suse.com/1263934","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1263993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263996","tags":["report"]},{"url":"https://bugzilla.suse.com/1264000","tags":["report"]},{"url":"https://bugzilla.suse.com/1264011","tags":["report"]},{"url":"https://bugzilla.suse.com/1264045","tags":["report"]},{"url":"https://bugzilla.suse.com/1264063","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264080","tags":["report"]},{"url":"https://bugzilla.suse.com/1264084","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264116","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264137","tags":["report"]},{"url":"https://bugzilla.suse.com/1264145","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264239","tags":["report"]},{"url":"https://bugzilla.suse.com/1264243","tags":["report"]},{"url":"https://bugzilla.suse.com/1264245","tags":["report"]},{"url":"https://bugzilla.suse.com/1264255","tags":["report"]},{"url":"https://bugzilla.suse.com/1264263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264266","tags":["report"]},{"url":"https://bugzilla.suse.com/1264300","tags":["report"]},{"url":"https://bugzilla.suse.com/1264409","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264437","tags":["report"]},{"url":"https://bugzilla.suse.com/1264444","tags":["report"]},{"url":"https://bugzilla.suse.com/1264449","tags":["report"]},{"url":"https://bugzilla.suse.com/1264470","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264484","tags":["report"]},{"url":"https://bugzilla.suse.com/1264549","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264561","tags":["report"]},{"url":"https://bugzilla.suse.com/1264595","tags":["report"]},{"url":"https://bugzilla.suse.com/1264603","tags":["report"]},{"url":"https://bugzilla.suse.com/1264610","tags":["report"]},{"url":"https://bugzilla.suse.com/1264669","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264672","tags":["report"]},{"url":"https://bugzilla.suse.com/1264716","tags":["report"]},{"url":"https://bugzilla.suse.com/1264719","tags":["report"]},{"url":"https://bugzilla.suse.com/1264720","tags":["report"]},{"url":"https://bugzilla.suse.com/1264722","tags":["report"]},{"url":"https://bugzilla.suse.com/1264726","tags":["report"]},{"url":"https://bugzilla.suse.com/1264741","tags":["report"]},{"url":"https://bugzilla.suse.com/1264763","tags":["report"]},{"url":"https://bugzilla.suse.com/1264765","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1264989","tags":["report"]},{"url":"https://bugzilla.suse.com/1265020","tags":["report"]},{"url":"https://bugzilla.suse.com/1265044","tags":["report"]},{"url":"https://bugzilla.suse.com/1265073","tags":["report"]},{"url":"https://bugzilla.suse.com/1265103","tags":["report"]},{"url":"https://bugzilla.suse.com/1265110","tags":["report"]},{"url":"https://bugzilla.suse.com/1265128","tags":["report"]},{"url":"https://bugzilla.suse.com/1265143","tags":["report"]},{"url":"https://bugzilla.suse.com/1265170","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265579","tags":["report"]},{"url":"https://bugzilla.suse.com/1265628","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1265960","tags":["report"]},{"url":"https://bugzilla.suse.com/1266001","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266214","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266307","tags":["report"]},{"url":"https://bugzilla.suse.com/1266390","tags":["report"]},{"url":"https://bugzilla.suse.com/1266394","tags":["report"]},{"url":"https://bugzilla.suse.com/1266395","tags":["report"]},{"url":"https://bugzilla.suse.com/1266397","tags":["report"]},{"url":"https://bugzilla.suse.com/1266400","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266414","tags":["report"]},{"url":"https://bugzilla.suse.com/1266452","tags":["report"]},{"url":"https://bugzilla.suse.com/1266696","tags":["report"]},{"url":"https://bugzilla.suse.com/1266697","tags":["report"]},{"url":"https://bugzilla.suse.com/1266698","tags":["report"]},{"url":"https://bugzilla.suse.com/1266704","tags":["report"]},{"url":"https://bugzilla.suse.com/1266705","tags":["report"]},{"url":"https://bugzilla.suse.com/1266711","tags":["report"]},{"url":"https://bugzilla.suse.com/1266720","tags":["report"]},{"url":"https://bugzilla.suse.com/1266759","tags":["report"]},{"url":"https://bugzilla.suse.com/1266765","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266810","tags":["report"]},{"url":"https://bugzilla.suse.com/1266816","tags":["report"]},{"url":"https://bugzilla.suse.com/1266826","tags":["report"]},{"url":"https://bugzilla.suse.com/1266827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266878","tags":["report"]},{"url":"https://bugzilla.suse.com/1266889","tags":["report"]},{"url":"https://bugzilla.suse.com/1266895","tags":["report"]},{"url":"https://bugzilla.suse.com/1266901","tags":["report"]},{"url":"https://bugzilla.suse.com/1266903","tags":["report"]},{"url":"https://bugzilla.suse.com/1266916","tags":["report"]},{"url":"https://bugzilla.suse.com/1266922","tags":["report"]},{"url":"https://bugzilla.suse.com/1266927","tags":["report"]},{"url":"https://bugzilla.suse.com/1266933","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1266972","tags":["report"]},{"url":"https://bugzilla.suse.com/1267205","tags":["report"]},{"url":"https://bugzilla.suse.com/1267208","tags":["report"]},{"url":"https://bugzilla.suse.com/1267214","tags":["report"]},{"url":"https://bugzilla.suse.com/1267218","tags":["report"]},{"url":"https://bugzilla.suse.com/1267220","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267361","tags":["report"]},{"url":"https://bugzilla.suse.com/1267381","tags":["report"]},{"url":"https://bugzilla.suse.com/1267387","tags":["report"]},{"url":"https://bugzilla.suse.com/1267431","tags":["report"]},{"url":"https://bugzilla.suse.com/1267531","tags":["report"]},{"url":"https://bugzilla.suse.com/1267621","tags":["report"]},{"url":"https://bugzilla.suse.com/1267624","tags":["report"]},{"url":"https://bugzilla.suse.com/1267626","tags":["report"]},{"url":"https://bugzilla.suse.com/1267628","tags":["report"]},{"url":"https://bugzilla.suse.com/1267640","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267652","tags":["report"]},{"url":"https://bugzilla.suse.com/1267654","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267682","tags":["report"]},{"url":"https://bugzilla.suse.com/1267685","tags":["report"]},{"url":"https://bugzilla.suse.com/1267697","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267732","tags":["report"]},{"url":"https://bugzilla.suse.com/1267744","tags":["report"]},{"url":"https://bugzilla.suse.com/1268307","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622436-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622458-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622460-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622742-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149651","tags":["report"]},{"url":"https://bugzilla.suse.com/1204315","tags":["report"]},{"url":"https://bugzilla.suse.com/1236743","tags":["report"]},{"url":"https://bugzilla.suse.com/1255029","tags":["report"]},{"url":"https://bugzilla.suse.com/1257506","tags":["report"]},{"url":"https://bugzilla.suse.com/1259800","tags":["report"]},{"url":"https://bugzilla.suse.com/1260565","tags":["report"]},{"url":"https://bugzilla.suse.com/1261250","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1261604","tags":["report"]},{"url":"https://bugzilla.suse.com/1262430","tags":["report"]},{"url":"https://bugzilla.suse.com/1262618","tags":["report"]},{"url":"https://bugzilla.suse.com/1262765","tags":["report"]},{"url":"https://bugzilla.suse.com/1263057","tags":["report"]},{"url":"https://bugzilla.suse.com/1263072","tags":["report"]},{"url":"https://bugzilla.suse.com/1263133","tags":["report"]},{"url":"https://bugzilla.suse.com/1263169","tags":["report"]},{"url":"https://bugzilla.suse.com/1263573","tags":["report"]},{"url":"https://bugzilla.suse.com/1263581","tags":["report"]},{"url":"https://bugzilla.suse.com/1263796","tags":["report"]},{"url":"https://bugzilla.suse.com/1263998","tags":["report"]},{"url":"https://bugzilla.suse.com/1264001","tags":["report"]},{"url":"https://bugzilla.suse.com/1264007","tags":["report"]},{"url":"https://bugzilla.suse.com/1264010","tags":["report"]},{"url":"https://bugzilla.suse.com/1264012","tags":["report"]},{"url":"https://bugzilla.suse.com/1264015","tags":["report"]},{"url":"https://bugzilla.suse.com/1264056","tags":["report"]},{"url":"https://bugzilla.suse.com/1264067","tags":["report"]},{"url":"https://bugzilla.suse.com/1264230","tags":["report"]},{"url":"https://bugzilla.suse.com/1264231","tags":["report"]},{"url":"https://bugzilla.suse.com/1264236","tags":["report"]},{"url":"https://bugzilla.suse.com/1264241","tags":["report"]},{"url":"https://bugzilla.suse.com/1264250","tags":["report"]},{"url":"https://bugzilla.suse.com/1264254","tags":["report"]},{"url":"https://bugzilla.suse.com/1264258","tags":["report"]},{"url":"https://bugzilla.suse.com/1264261","tags":["report"]},{"url":"https://bugzilla.suse.com/1264270","tags":["report"]},{"url":"https://bugzilla.suse.com/1264286","tags":["report"]},{"url":"https://bugzilla.suse.com/1264294","tags":["report"]},{"url":"https://bugzilla.suse.com/1264295","tags":["report"]},{"url":"https://bugzilla.suse.com/1264302","tags":["report"]},{"url":"https://bugzilla.suse.com/1264304","tags":["report"]},{"url":"https://bugzilla.suse.com/1264320","tags":["report"]},{"url":"https://bugzilla.suse.com/1264328","tags":["report"]},{"url":"https://bugzilla.suse.com/1264333","tags":["report"]},{"url":"https://bugzilla.suse.com/1264337","tags":["report"]},{"url":"https://bugzilla.suse.com/1264372","tags":["report"]},{"url":"https://bugzilla.suse.com/1264386","tags":["report"]},{"url":"https://bugzilla.suse.com/1264429","tags":["report"]},{"url":"https://bugzilla.suse.com/1264532","tags":["report"]},{"url":"https://bugzilla.suse.com/1264544","tags":["report"]},{"url":"https://bugzilla.suse.com/1264545","tags":["report"]},{"url":"https://bugzilla.suse.com/1264548","tags":["report"]},{"url":"https://bugzilla.suse.com/1264556","tags":["report"]},{"url":"https://bugzilla.suse.com/1264580","tags":["report"]},{"url":"https://bugzilla.suse.com/1264612","tags":["report"]},{"url":"https://bugzilla.suse.com/1264614","tags":["report"]},{"url":"https://bugzilla.suse.com/1264624","tags":["report"]},{"url":"https://bugzilla.suse.com/1264643","tags":["report"]},{"url":"https://bugzilla.suse.com/1264734","tags":["report"]},{"url":"https://bugzilla.suse.com/1264740","tags":["report"]},{"url":"https://bugzilla.suse.com/1264744","tags":["report"]},{"url":"https://bugzilla.suse.com/1264789","tags":["report"]},{"url":"https://bugzilla.suse.com/1264790","tags":["report"]},{"url":"https://bugzilla.suse.com/1264794","tags":["report"]},{"url":"https://bugzilla.suse.com/1264852","tags":["report"]},{"url":"https://bugzilla.suse.com/1264974","tags":["report"]},{"url":"https://bugzilla.suse.com/1264978","tags":["report"]},{"url":"https://bugzilla.suse.com/1264997","tags":["report"]},{"url":"https://bugzilla.suse.com/1265000","tags":["report"]},{"url":"https://bugzilla.suse.com/1265005","tags":["report"]},{"url":"https://bugzilla.suse.com/1265023","tags":["report"]},{"url":"https://bugzilla.suse.com/1265079","tags":["report"]},{"url":"https://bugzilla.suse.com/1265082","tags":["report"]},{"url":"https://bugzilla.suse.com/1265084","tags":["report"]},{"url":"https://bugzilla.suse.com/1265091","tags":["report"]},{"url":"https://bugzilla.suse.com/1265097","tags":["report"]},{"url":"https://bugzilla.suse.com/1265112","tags":["report"]},{"url":"https://bugzilla.suse.com/1265113","tags":["report"]},{"url":"https://bugzilla.suse.com/1265123","tags":["report"]},{"url":"https://bugzilla.suse.com/1265129","tags":["report"]},{"url":"https://bugzilla.suse.com/1265142","tags":["report"]},{"url":"https://bugzilla.suse.com/1265629","tags":["report"]},{"url":"https://bugzilla.suse.com/1266008","tags":["report"]},{"url":"https://bugzilla.suse.com/1266283","tags":["report"]},{"url":"https://bugzilla.suse.com/1266284","tags":["report"]},{"url":"https://bugzilla.suse.com/1266396","tags":["report"]},{"url":"https://bugzilla.suse.com/1266398","tags":["report"]},{"url":"https://bugzilla.suse.com/1266458","tags":["report"]},{"url":"https://bugzilla.suse.com/1266686","tags":["report"]},{"url":"https://bugzilla.suse.com/1266693","tags":["report"]},{"url":"https://bugzilla.suse.com/1266700","tags":["report"]},{"url":"https://bugzilla.suse.com/1266717","tags":["report"]},{"url":"https://bugzilla.suse.com/1266718","tags":["report"]},{"url":"https://bugzilla.suse.com/1266722","tags":["report"]},{"url":"https://bugzilla.suse.com/1266726","tags":["report"]},{"url":"https://bugzilla.suse.com/1266734","tags":["report"]},{"url":"https://bugzilla.suse.com/1266740","tags":["report"]},{"url":"https://bugzilla.suse.com/1266750","tags":["report"]},{"url":"https://bugzilla.suse.com/1266754","tags":["report"]},{"url":"https://bugzilla.suse.com/1266761","tags":["report"]},{"url":"https://bugzilla.suse.com/1266773","tags":["report"]},{"url":"https://bugzilla.suse.com/1266805","tags":["report"]},{"url":"https://bugzilla.suse.com/1266830","tags":["report"]},{"url":"https://bugzilla.suse.com/1266838","tags":["report"]},{"url":"https://bugzilla.suse.com/1266840","tags":["report"]},{"url":"https://bugzilla.suse.com/1266847","tags":["report"]},{"url":"https://bugzilla.suse.com/1266883","tags":["report"]},{"url":"https://bugzilla.suse.com/1266892","tags":["report"]},{"url":"https://bugzilla.suse.com/1266893","tags":["report"]},{"url":"https://bugzilla.suse.com/1266899","tags":["report"]},{"url":"https://bugzilla.suse.com/1266925","tags":["report"]},{"url":"https://bugzilla.suse.com/1266929","tags":["report"]},{"url":"https://bugzilla.suse.com/1267228","tags":["report"]},{"url":"https://bugzilla.suse.com/1267238","tags":["report"]},{"url":"https://bugzilla.suse.com/1267251","tags":["report"]},{"url":"https://bugzilla.suse.com/1267360","tags":["report"]},{"url":"https://bugzilla.suse.com/1267365","tags":["report"]},{"url":"https://bugzilla.suse.com/1267369","tags":["report"]},{"url":"https://bugzilla.suse.com/1267419","tags":["report"]},{"url":"https://bugzilla.suse.com/1267427","tags":["report"]},{"url":"https://bugzilla.suse.com/1267437","tags":["report"]},{"url":"https://bugzilla.suse.com/1267458","tags":["report"]},{"url":"https://bugzilla.suse.com/1267493","tags":["report"]},{"url":"https://bugzilla.suse.com/1267505","tags":["report"]},{"url":"https://bugzilla.suse.com/1267548","tags":["report"]},{"url":"https://bugzilla.suse.com/1267582","tags":["report"]},{"url":"https://bugzilla.suse.com/1267591","tags":["report"]},{"url":"https://bugzilla.suse.com/1267600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267618","tags":["report"]},{"url":"https://bugzilla.suse.com/1267635","tags":["report"]},{"url":"https://bugzilla.suse.com/1267637","tags":["report"]},{"url":"https://bugzilla.suse.com/1267684","tags":["report"]},{"url":"https://bugzilla.suse.com/1267717","tags":["report"]},{"url":"https://bugzilla.suse.com/1267722","tags":["report"]},{"url":"https://bugzilla.suse.com/1267816","tags":["report"]},{"url":"https://bugzilla.suse.com/1267824","tags":["report"]},{"url":"https://bugzilla.suse.com/1267825","tags":["report"]},{"url":"https://bugzilla.suse.com/1267937","tags":["report"]},{"url":"https://bugzilla.suse.com/1267966","tags":["report"]},{"url":"https://bugzilla.suse.com/1267992","tags":["report"]},{"url":"https://bugzilla.suse.com/1267993","tags":["report"]},{"url":"https://bugzilla.suse.com/1267994","tags":["report"]},{"url":"https://bugzilla.suse.com/1268022","tags":["report"]},{"url":"https://bugzilla.suse.com/1268037","tags":["report"]},{"url":"https://bugzilla.suse.com/1268237","tags":["report"]},{"url":"https://bugzilla.suse.com/1268238","tags":["report"]},{"url":"https://bugzilla.suse.com/1268276","tags":["report"]},{"url":"https://bugzilla.suse.com/1268335","tags":["report"]},{"url":"https://bugzilla.suse.com/1268428","tags":["report"]},{"url":"https://bugzilla.suse.com/1268660","tags":["report"]},{"url":"https://bugzilla.suse.com/1268661","tags":["report"]},{"url":"https://bugzilla.suse.com/1268989","tags":["report"]},{"url":"https://bugzilla.suse.com/1269022","tags":["report"]},{"url":"https://bugzilla.suse.com/1269031","tags":["report"]},{"url":"https://bugzilla.suse.com/1269033","tags":["report"]},{"url":"https://bugzilla.suse.com/1269036","tags":["report"]},{"url":"https://bugzilla.suse.com/1269087","tags":["report"]},{"url":"https://bugzilla.suse.com/1269103","tags":["report"]},{"url":"https://bugzilla.suse.com/1269135","tags":["report"]},{"url":"https://bugzilla.suse.com/1269136","tags":["report"]},{"url":"https://bugzilla.suse.com/1269137","tags":["report"]},{"url":"https://bugzilla.suse.com/1269151","tags":["report"]},{"url":"https://bugzilla.suse.com/1269159","tags":["report"]},{"url":"https://bugzilla.suse.com/1269164","tags":["report"]},{"url":"https://bugzilla.suse.com/1269188","tags":["report"]},{"url":"https://bugzilla.suse.com/1269193","tags":["report"]},{"url":"https://bugzilla.suse.com/1269199","tags":["report"]},{"url":"https://bugzilla.suse.com/1269230","tags":["report"]},{"url":"https://bugzilla.suse.com/1269234","tags":["report"]},{"url":"https://bugzilla.suse.com/1269252","tags":["report"]},{"url":"https://bugzilla.suse.com/1269262","tags":["report"]},{"url":"https://bugzilla.suse.com/1269288","tags":["report"]},{"url":"https://bugzilla.suse.com/1269310","tags":["report"]},{"url":"https://bugzilla.suse.com/1269389","tags":["report"]},{"url":"https://bugzilla.suse.com/1269392","tags":["report"]},{"url":"https://bugzilla.suse.com/1269397","tags":["report"]},{"url":"https://bugzilla.suse.com/1269398","tags":["report"]},{"url":"https://bugzilla.suse.com/1269416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269418","tags":["report"]},{"url":"https://bugzilla.suse.com/1269493","tags":["report"]},{"url":"https://bugzilla.suse.com/1269506","tags":["report"]},{"url":"https://bugzilla.suse.com/1269519","tags":["report"]},{"url":"https://bugzilla.suse.com/1269527","tags":["report"]},{"url":"https://bugzilla.suse.com/1269531","tags":["report"]},{"url":"https://bugzilla.suse.com/1269532","tags":["report"]},{"url":"https://bugzilla.suse.com/1269537","tags":["report"]},{"url":"https://bugzilla.suse.com/1269587","tags":["report"]},{"url":"https://bugzilla.suse.com/1269617","tags":["report"]},{"url":"https://bugzilla.suse.com/1269645","tags":["report"]},{"url":"https://bugzilla.suse.com/1269646","tags":["report"]},{"url":"https://bugzilla.suse.com/1269647","tags":["report"]},{"url":"https://bugzilla.suse.com/1269651","tags":["report"]},{"url":"https://bugzilla.suse.com/1269680","tags":["report"]},{"url":"https://bugzilla.suse.com/1269690","tags":["report"]},{"url":"https://bugzilla.suse.com/1269691","tags":["report"]},{"url":"https://bugzilla.suse.com/1269700","tags":["report"]},{"url":"https://bugzilla.suse.com/1269708","tags":["report"]},{"url":"https://bugzilla.suse.com/1269710","tags":["report"]},{"url":"https://bugzilla.suse.com/1269768","tags":["report"]},{"url":"https://bugzilla.suse.com/1269795","tags":["report"]},{"url":"https://bugzilla.suse.com/1269798","tags":["report"]},{"url":"https://bugzilla.suse.com/1269809","tags":["report"]},{"url":"https://bugzilla.suse.com/1269814","tags":["report"]},{"url":"https://bugzilla.suse.com/1269821","tags":["report"]},{"url":"https://bugzilla.suse.com/1269904","tags":["report"]},{"url":"https://bugzilla.suse.com/1269982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269989","tags":["report"]},{"url":"https://bugzilla.suse.com/1269992","tags":["report"]},{"url":"https://bugzilla.suse.com/1270000","tags":["report"]},{"url":"https://bugzilla.suse.com/1270022","tags":["report"]},{"url":"https://bugzilla.suse.com/1270042","tags":["report"]},{"url":"https://bugzilla.suse.com/1270059","tags":["report"]},{"url":"https://bugzilla.suse.com/1270226","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53362","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622769-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622812-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622835-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262722-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260531","tags":["report"]},{"url":"https://bugzilla.suse.com/1263124","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31593","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262799-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259764","tags":["report"]},{"url":"https://bugzilla.suse.com/1262655","tags":["report"]},{"url":"https://bugzilla.suse.com/1263560","tags":["report"]},{"url":"https://bugzilla.suse.com/1264228","tags":["report"]},{"url":"https://bugzilla.suse.com/1264562","tags":["report"]},{"url":"https://bugzilla.suse.com/1264748","tags":["report"]},{"url":"https://bugzilla.suse.com/1264814","tags":["report"]},{"url":"https://bugzilla.suse.com/1265211","tags":["report"]},{"url":"https://bugzilla.suse.com/1265421","tags":["report"]},{"url":"https://bugzilla.suse.com/1266928","tags":["report"]},{"url":"https://bugzilla.suse.com/1267430","tags":["report"]},{"url":"https://bugzilla.suse.com/1267567","tags":["report"]},{"url":"https://bugzilla.suse.com/1267918","tags":["report"]},{"url":"https://bugzilla.suse.com/1267953","tags":["report"]},{"url":"https://bugzilla.suse.com/1268159","tags":["report"]},{"url":"https://bugzilla.suse.com/1269090","tags":["report"]},{"url":"https://bugzilla.suse.com/1269100","tags":["report"]},{"url":"https://bugzilla.suse.com/1269184","tags":["report"]},{"url":"https://bugzilla.suse.com/1269195","tags":["report"]},{"url":"https://bugzilla.suse.com/1269281","tags":["report"]},{"url":"https://bugzilla.suse.com/1269314","tags":["report"]},{"url":"https://bugzilla.suse.com/1269574","tags":["report"]},{"url":"https://bugzilla.suse.com/1269678","tags":["report"]},{"url":"https://bugzilla.suse.com/1269681","tags":["report"]},{"url":"https://bugzilla.suse.com/1269884","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53253","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-43345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43345","tags":["report"]},{"url":"https://git.kernel.org/linus/56007972c0b1e783ca714d6f1f4d6e66e531d21f","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8567-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8574-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8574-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8595-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8596-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8595-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8606-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8607-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8608-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8609-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8574-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8595-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8619-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8665-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-21709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-54505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-54518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-62626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31655","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31657","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64587","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43345","title":"net: ipa: fix event ring index not programmed for IPA v5.0+","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T13:39:31.222Z","modified":"2026-08-05T12:27:22.811Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-28629","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T13:39:31Z","modified":"2026-08-05T12:27:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:11.744454Z"}],"ghsa":[{"id":"GHSA-7657-q549-6g59","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T15:31:24Z","modified":"2026-05-11T09:31:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:07:59.393178Z"}],"nvd":[{"id":"CVE-2026-43345","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T14:16:44.547Z","modified":"2026-06-17T10:49:25.5Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"BELL-CVE-2026-43345","status":"published","published":"2026-05-09T06:09:30.489536Z","modified":"2026-06-25T07:18:41.030696006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-43345","title":"net: ipa: fix event ring index not programmed for IPA v5.0+","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T13:39:31.222Z","modified":"2026-10-28T02:31:10.576294731Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:04.479642Z"},{"id":"DEBIAN-CVE-2026-43345","description":"In the Linux kernel, the following vulnerability has been resolved:  net: ipa: fix event ring index not programmed for IPA v5.0+  For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX.  Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().  At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T14:16:44.547Z","modified":"2026-10-01T03:03:12.887115069Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"OESA-2026-2581","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: Prevent parser TCAM memory corruption\n\nProtect the parser TCAM/SRAM memory, and the cached (shadow) SRAM\ninformation, from concurrent modifications.\n\nBoth the TCAM and SRAM tables are indirectly accessed by configuring\nan index register that selects the row to read or write to. This means\nthat operations must be atomic in order to, e.g., avoid spreading\nwrites across multiple rows. Since the shadow SRAM array is used to\nfind free rows in the hardware table, it must also be protected in\norder to avoid TOCTOU errors where multiple cores allocate the same\nrow.\n\nThis issue was detected in a situation where `mvpp2_set_rx_mode()` ran\nconcurrently on two CPUs. In this particular case the\nMVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the\nclassifier unit to drop all incoming unicast - indicated by the\n`rx_classifier_drops` counter.(CVE-2025-22060)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix NULL pointer in can_accept_new_subflow\n\nWhen testing valkey benchmark tool with MPTCP, the kernel panics in\n\u0026apos;mptcp_can_accept_new_subflow\u0026apos; because subflow_req-\u0026gt;msk is NULL.\n\nCall trace:\n\n  mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P)\n  subflow_syn_recv_sock (./net/mptcp/subflow.c:854)\n  tcp_check_req (./net/ipv4/tcp_minisocks.c:863)\n  tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268)\n  ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207)\n  ip_local_deliver_finish (./net/ipv4/ip_input.c:234)\n  ip_local_deliver (./net/ipv4/ip_input.c:254)\n  ip_rcv_finish (./net/ipv4/ip_input.c:449)\n  ...\n\nAccording to the debug log, the same req received two SYN-ACK in a very\nshort time, very likely because the client retransmits the syn ack due\nto multiple reasons.\n\nEven if the packets are transmitted with a relevant time interval, they\ncan be processed by the server on different CPUs concurrently). The\n\u0026apos;subflow_req-\u0026gt;msk\u0026apos; ownership is transferred to the subflow the first,\nand there will be a risk of a null pointer dereference here.\n\nThis patch fixes this issue by moving the \u0026apos;subflow_req-\u0026gt;msk\u0026apos; under the\n`own_req == true` conditional.\n\nNote that the !msk check in subflow_hmac_valid() can be dropped, because\nthe same check already exists under the own_req mpj branch where the\ncode has been moved to.(CVE-2025-23145)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitialized timer\n\nWith CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads\nto the following splat:\n\n[  250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0\n[  250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0\n[  250.218775] Modules linked in: hfcpci(-) mISDN_core\n[  250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary)\n[  250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0\n[  250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d\n[  250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286\n[  250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95\n[  250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0\n[  250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39\n[  250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001\n[  250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8\n[  250.232454] FS:  00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000\n[  250.233851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0\n[  250.236117] Call Trace:\n[  250.236599]  \u0026lt;TASK\u0026gt;\n[  250.236967]  ? trace_irq_enable.constprop.0+0xd4/0x130\n[  250.237920]  debug_object_assert_init+0x1f6/0x310\n[  250.238762]  ? __pfx_debug_object_assert_init+0x10/0x10\n[  250.239658]  ? __lock_acquire+0xdea/0x1c70\n[  250.240369]  __try_to_del_timer_sync+0x69/0x140\n[  250.241172]  ? __pfx___try_to_del_timer_sync+0x10/0x10\n[  250.242058]  ? __timer_delete_sync+0xc6/0x120\n[  250.242842]  ? lock_acquire+0x30/0x80\n[  250.243474]  ? __timer_delete_sync+0xc6/0x120\n[  250.244262]  __timer_delete_sync+0x98/0x120\n[  250.245015]  HFC_cleanup+0x10/0x20 [hfcpci]\n[  250.245704]  __do_sys_delete_module+0x348/0x510\n[  250.246461]  ? __pfx___do_sys_delete_module+0x10/0x10\n[  250.247338]  do_syscall_64+0xc1/0x360\n[  250.247924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by initializing hfc_tl timer with DEFINE_TIMER macro.\nAlso, use mod_timer instead of manual timeout update.(CVE-2025-39833)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Add support for Van Gogh SoC\n\nThe ROG Xbox Ally (non-X) SoC features a similar architecture to the\nSteam Deck. While the Steam Deck supports S3 (s2idle causes a crash),\nthis support was dropped by the Xbox Ally which only S0ix suspend.\n\nSince the handler is missing here, this causes the device to not suspend\nand the AMD GPU driver to crash while trying to resume afterwards due to\na power hang.(CVE-2025-68334)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops-\u0026gt;create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n  - If port_dev is not the same type as dev, dev takes mtu from port_dev\n  - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev-\u0026gt;mtu = dev-\u0026gt;mtu and instead\nletting team_dev_type_check_change assign dev-\u0026gt;mtu = port_dev-\u0026gt;mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n  - team device driver in-tree selftests\n  - Add/remove various devices as slaves of team device\n  - syzbot(CVE-2025-68340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: asix: validate PHY address before use\n\nThe ASIX driver reads the PHY address from the USB device via\nasix_read_phy_addr(). A malicious or faulty device can return an\ninvalid address (\u0026gt;= PHY_MAX_ADDR), which causes a warning in\nmdiobus_get_phy():\n\n  addr 207 out of range\n  WARNING: drivers/net/phy/mdio_bus.c:76\n\nValidate the PHY address in asix_read_phy_addr() and remove the\nnow-redundant check in ax88172a.c.(CVE-2025-71094)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: make ip6gre_header() robust\n\nOver the years, syzbot found many ways to crash the kernel\nin ip6gre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ip6gre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:213 !\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  neigh_output include/net/neighbour.h:556 [inline]\n  ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136\n __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]\n  ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693(CVE-2025-71098)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: add VLAN id validation before using\n\nCurrently, the VLAN id may be used without validation when\nreceive a VLAN configuration mailbox from VF. The length of\nvlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause\nout-of-bounds memory access once the VLAN id is bigger than\nor equal to VLAN_N_VID.\n\nTherefore, VLAN id needs to be checked to ensure it is within\nthe range of VLAN_N_VID.(CVE-2025-71112)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix string copying in parse_apply_sb_mount_options()\n\nstrscpy_pad() can\u0026apos;t be used to copy a non-NUL-term string into a NUL-term\nstring of possibly bigger size.  Commit 0efc5990bca5 (\u0026quot;string.h: Introduce\nmemtostr() and memtostr_pad()\u0026quot;) provides additional information in that\nregard.  So if this happens, the following warning is observed:\n\nstrnlen: detected buffer overflow: 65 byte read of buffer size 64\nWARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032\nModules linked in:\nCPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039\n strnlen include/linux/fortify-string.h:235 [inline]\n sized_strscpy include/linux/fortify-string.h:309 [inline]\n parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline]\n __ext4_fill_super fs/ext4/super.c:5261 [inline]\n ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706\n get_tree_bdev_flags+0x387/0x620 fs/super.c:1636\n vfs_get_tree+0x93/0x380 fs/super.c:1814\n do_new_mount fs/namespace.c:3553 [inline]\n path_mount+0x6ae/0x1f70 fs/namespace.c:3880\n do_mount fs/namespace.c:3893 [inline]\n __do_sys_mount fs/namespace.c:4103 [inline]\n __se_sys_mount fs/namespace.c:4080 [inline]\n __x64_sys_mount+0x280/0x300 fs/namespace.c:4080\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nSince userspace is expected to provide s_mount_opts field to be at most 63\ncharacters long with the ending byte being NUL-term, use a 64-byte buffer\nwhich matches the size of s_mount_opts, so that strscpy_pad() does its job\nproperly.  Return with error if the user still managed to provide a\nnon-NUL-term string here.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-71123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer\n\nInitialize the eb.vma array with values of 0 when the eb structure is\nfirst set up. In particular, this sets the eb-\u0026gt;vma[i].vma pointers to\nNULL, simplifying cleanup and getting rid of the bug described below.\n\nDuring the execution of eb_lookup_vmas(), the eb-\u0026gt;vma array is\nsuccessively filled up with struct eb_vma objects. This process includes\ncalling eb_add_vma(), which might fail; however, even in the event of\nfailure, eb-\u0026gt;vma[i].vma is set for the currently processed buffer.\n\nIf eb_add_vma() fails, eb_lookup_vmas() returns with an error, which\nprompts a call to eb_release_vmas() to clean up the mess. Since\neb_lookup_vmas() might fail during processing any (possibly not first)\nbuffer, eb_release_vmas() checks whether a buffer\u0026apos;s vma is NULL to know\nat what point did the lookup function fail.\n\nIn eb_lookup_vmas(), eb-\u0026gt;vma[i].vma is set to NULL if either the helper\nfunction eb_lookup_vma() or eb_validate_vma() fails. eb-\u0026gt;vma[i+1].vma is\nset to NULL in case i915_gem_object_userptr_submit_init() fails; the\ncurrent one needs to be cleaned up by eb_release_vmas() at this point,\nso the next one is set. If eb_add_vma() fails, neither the current nor\nthe next vma is set to NULL, which is a source of a NULL deref bug\ndescribed in the issue linked in the Closes tag.\n\nWhen entering eb_lookup_vmas(), the vma pointers are set to the slab\npoison value, instead of NULL. This doesn\u0026apos;t matter for the actual\nlookup, since it gets overwritten anyway, however the eb_release_vmas()\nfunction only recognizes NULL as the stopping value, hence the pointers\nare being set to NULL as they go in case of intermediate failure. This\npatch changes the approach to filling them all with NULL at the start\ninstead, rather than handling that manually during failure.\n\n(cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd)(CVE-2025-71130)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmc91x: fix broken irq-context in PREEMPT_RT\n\nWhen smc91x.c is built with PREEMPT_RT, the following splat occurs\nin FVP_RevC:\n\n[   13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000\n[   13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106]\n[   13.062137]      preempt=0x00000000 lock=0-\u0026gt;0 RCU=0-\u0026gt;1 workfn=mld_ifc_work\n[   13.062266] C\n** replaying previous printk message **\n[   13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)}\n[   13.062353] Hardware name:  , BIOS\n[   13.062382] Workqueue: mld mld_ifc_work\n[   13.062469] Call trace:\n[   13.062494]  show_stack+0x24/0x40 (C)\n[   13.062602]  __dump_stack+0x28/0x48\n[   13.062710]  dump_stack_lvl+0x7c/0xb0\n[   13.062818]  dump_stack+0x18/0x34\n[   13.062926]  process_scheduled_works+0x294/0x450\n[   13.063043]  worker_thread+0x260/0x3d8\n[   13.063124]  kthread+0x1c4/0x228\n[   13.063235]  ret_from_fork+0x10/0x20\n\nThis happens because smc_special_trylock() disables IRQs even on PREEMPT_RT,\nbut smc_special_unlock() does not restore IRQs on PREEMPT_RT.\nThe reason is that smc_special_unlock() calls spin_unlock_irqrestore(),\nand rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke\nrcu_read_unlock() through __local_bh_enable_ip() when current-\u0026gt;softirq_disable_cnt becomes zero.\n\nTo address this issue, replace smc_special_trylock() with spin_trylock_irqsave().(CVE-2025-71132)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: avoid chain re-validation if possible\n\nHamza Mahfooz reports cpu soft lock-ups in\nnft_chain_validate():\n\n watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re:37547]\n[..]\n RIP: 0010:nft_chain_validate+0xcb/0x110 [nf_tables]\n[..]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_immediate_validate+0x36/0x50 [nf_tables]\n  nft_chain_validate+0xc9/0x110 [nf_tables]\n  nft_table_validate+0x6b/0xb0 [nf_tables]\n  nf_tables_validate+0x8b/0xa0 [nf_tables]\n  nf_tables_commit+0x1df/0x1eb0 [nf_tables]\n[..]\n\nCurrently nf_tables will traverse the entire table (chain graph), starting\nfrom the entry points (base chains), exploring all possible paths\n(chain jumps).  But there are cases where we could avoid revalidation.\n\nConsider:\n1  input -\u0026gt; j2 -\u0026gt; j3\n2  input -\u0026gt; j2 -\u0026gt; j3\n3  input -\u0026gt; j1 -\u0026gt; j2 -\u0026gt; j3\n\nThen the second rule does not need to revalidate j2, and, by extension j3,\nbecause this was already checked during validation of the first rule.\nWe need to validate it only for rule 3.\n\nThis is needed because chain loop detection also ensures we do not exceed\nthe jump stack: Just because we know that j2 is cycle free, its last jump\nmight now exceed the allowed stack size.  We also need to update all\nreachable chains with the new largest observed call depth.\n\nCare has to be taken to revalidate even if the chain depth won\u0026apos;t be an\nissue: chain validation also ensures that expressions are not called from\ninvalid base chains.  For example, the masquerade expression can only be\ncalled from NAT postrouting base chains.\n\nTherefore we also need to keep record of the base chain context (type,\nhooknum) and revalidate if the chain becomes reachable from a different\nhook location.(CVE-2025-71160)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock in wait_current_trans() due to ignored transaction type\n\nWhen wait_current_trans() is called during start_transaction(), it\ncurrently waits for a blocked transaction without considering whether\nthe given transaction type actually needs to wait for that particular\ntransaction state. The btrfs_blocked_trans_types[] array already defines\nwhich transaction types should wait for which transaction states, but\nthis check was missing in wait_current_trans().\n\nThis can lead to a deadlock scenario involving two transactions and\npending ordered extents:\n\n  1. Transaction A is in TRANS_STATE_COMMIT_DOING state\n\n  2. A worker processing an ordered extent calls start_transaction()\n     with TRANS_JOIN\n\n  3. join_transaction() returns -EBUSY because Transaction A is in\n     TRANS_STATE_COMMIT_DOING\n\n  4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes\n\n  5. A new Transaction B is created (TRANS_STATE_RUNNING)\n\n  6. The ordered extent from step 2 is added to Transaction B\u0026apos;s\n     pending ordered extents\n\n  7. Transaction B immediately starts commit by another task and\n     enters TRANS_STATE_COMMIT_START\n\n  8. The worker finally reaches wait_current_trans(), sees Transaction B\n     in TRANS_STATE_COMMIT_START (a blocked state), and waits\n     unconditionally\n\n  9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START\n     according to btrfs_blocked_trans_types[]\n\n  10. Transaction B is waiting for pending ordered extents to complete\n\n  11. Deadlock: Transaction B waits for ordered extent, ordered extent\n      waits for Transaction B\n\nThis can be illustrated by the following call stacks:\n  CPU0                              CPU1\n                                    btrfs_finish_ordered_io()\n                                      start_transaction(TRANS_JOIN)\n                                        join_transaction()\n                                          # -EBUSY (Transaction A is\n                                          # TRANS_STATE_COMMIT_DOING)\n  # Transaction A completes\n  # Transaction B created\n  # ordered extent added to\n  # Transaction B\u0026apos;s pending list\n  btrfs_commit_transaction()\n    # Transaction B enters\n    # TRANS_STATE_COMMIT_START\n    # waiting for pending ordered\n    # extents\n                                        wait_current_trans()\n                                          # waits for Transaction B\n                                          # (should not wait!)\n\nTask bstore_kv_sync in btrfs_commit_transaction waiting for ordered\nextents:\n\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  btrfs_commit_transaction+0xbf7/0xda0 [btrfs]\n  btrfs_sync_file+0x342/0x4d0 [btrfs]\n  __x64_sys_fdatasync+0x4b/0x80\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nTask kworker in wait_current_trans waiting for transaction commit:\n\n  Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs]\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  wait_current_trans+0xb0/0x110 [btrfs]\n  start_transaction+0x346/0x5b0 [btrfs]\n  btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs]\n  btrfs_work_helper+0xe8/0x350 [btrfs]\n  process_one_work+0x1d3/0x3c0\n  worker_thread+0x4d/0x3e0\n  kthread+0x12d/0x150\n  ret_from_fork+0x1f/0x30\n\nFix this by passing the transaction type to wait_current_trans() and\nchecking btrfs_blocked_trans_types[cur_trans-\u0026gt;state] against the given\ntype before deciding to wait. This ensures that transaction types which\nare allowed to join during certain blocked states will not unnecessarily\nwait and cause deadlocks.(CVE-2025-71194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/sva: invalidate stale IOTLB entries for kernel address space\n\nIntroduce a new IOMMU interface to flush IOTLB paging cache entries for\nthe CPU kernel address space.  This interface is invoked from the x86\narchitecture code that manages combined user and kernel page tables,\nspecifically before any kernel page table page is freed and reused.\n\nThis addresses the main issue with vfree() which is a common occurrence\nand can be triggered by unprivileged users.  While this resolves the\nprimary problem, it doesn\u0026apos;t address some extremely rare case related to\nmemory unplug of memory that was present as reserved memory at boot, which\ncannot be triggered by unprivileged users.  The discussion can be found at\nthe link below.\n\nEnable SVA on x86 architecture since the IOMMU can now receive\nnotification to flush the paging cache before freeing the CPU kernel page\ntable pages.(CVE-2025-71202)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naudit: add fchmodat2() to change attributes class\n\nfchmodat2(), introduced in version 6.6 is currently not in the change\nattribute class of audit. Calling fchmodat2() to change a file\nattribute in the same fashion than chmod() or fchmodat() will bypass\naudit rules such as:\n\n-w /tmp/test -p rwa -k test_rwa\n\nThe current patch adds fchmodat2() to the change attributes class.(CVE-2025-71239)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)-\u0026gt;vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry-\u0026gt;vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/(CVE-2026-23001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: ensure safe queue release with state management\n\nDirectly calling `put_queue` carries risks since it cannot\nguarantee that resources of `uacce_queue` have been fully released\nbeforehand. So adding a `stop_queue` operation for the\nUACCE_CMD_PUT_Q command and leaving the `put_queue` operation to\nthe final resource release ensures safety.\n\nQueue states are defined as follows:\n- UACCE_Q_ZOMBIE: Initial state\n- UACCE_Q_INIT: After opening `uacce`\n- UACCE_Q_STARTED: After `start` is issued via `ioctl`\n\nWhen executing `poweroff -f` in virt while accelerator are still\nworking, `uacce_fops_release` and `uacce_remove` may execute\nconcurrently. This can cause `uacce_put_queue` within\n`uacce_fops_release` to access a NULL `ops` pointer. Therefore, add\nstate checks to prevent accessing freed pointers.(CVE-2026-23063)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim \u0026lt;(CVE-2026-23074)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: signal: Fix restoration of SVE context\n\nWhen SME is supported, Restoring SVE signal context can go wrong in a\nfew ways, including placing the task into an invalid state where the\nkernel may read from out-of-bounds memory (and may potentially take a\nfatal fault) and/or may kill the task with a SIGKILL.\n\n(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into\n    an invalid state where SVCR.SM is set (and sve_state is non-NULL)\n    but TIF_SME is clear, consequently resuting in out-of-bounds memory\n    reads and/or killing the task with SIGKILL.\n\n    This can only occur in unusual (but legitimate) cases where the SVE\n    signal context has either been modified by userspace or was saved in\n    the context of another task (e.g. as with CRIU), as otherwise the\n    presence of an SVE signal context with SVE_SIG_FLAG_SM implies that\n    TIF_SME is already set.\n\n    While in this state, task_fpsimd_load() will NOT configure SMCR_ELx\n    (leaving some arbitrary value configured in hardware) before\n    restoring SVCR and attempting to restore the streaming mode SVE\n    registers from memory via sve_load_state(). As the value of\n    SMCR_ELx.LEN may be larger than the task\u0026apos;s streaming SVE vector\n    length, this may read memory outside of the task\u0026apos;s allocated\n    sve_state, reading unrelated data and/or triggering a fault.\n\n    While this can result in secrets being loaded into streaming SVE\n    registers, these values are never exposed. As TIF_SME is clear,\n    fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0\n    accesses to streaming mode SVE registers, so these cannot be\n    accessed directly at EL0. As fpsimd_save_user_state() verifies the\n    live vector length before saving (S)SVE state to memory, no secret\n    values can be saved back to memory (and hence cannot be observed via\n    ptrace, signals, etc).\n\n    When the live vector length doesn\u0026apos;t match the expected vector length\n    for the task, fpsimd_save_user_state() will send a fatal SIGKILL\n    signal to the task. Hence the task may be killed after executing\n    userspace for some period of time.\n\n(2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the\n    task\u0026apos;s SVCR.SM. If SVCR.SM was set prior to restoring the context,\n    then the task will be left in streaming mode unexpectedly, and some\n    register state will be combined inconsistently, though the task will\n    be left in legitimate state from the kernel\u0026apos;s PoV.\n\n    This can only occur in unusual (but legitimate) cases where ptrace\n    has been used to set SVCR.SM after entry to the sigreturn syscall,\n    as syscall entry clears SVCR.SM.\n\n    In these cases, the the provided SVE register data will be loaded\n    into the task\u0026apos;s sve_state using the non-streaming SVE vector length\n    and the FPSIMD registers will be merged into this using the\n    streaming SVE vector length.\n\nFix (1) by setting TIF_SME when setting SVCR.SM. This also requires\nensuring that the task\u0026apos;s sme_state has been allocated, but as this could\ncontain live ZA state, it should not be zeroed. Fix (2) by clearing\nSVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear.\n\nFor consistency, I\u0026apos;ve pulled the manipulation of SVCR, TIF_SVE, TIF_SME,\nand fp_type earlier, immediately after the allocation of\nsve_state/sme_state, before the restore of the actual register state.\nThis makes it easier to ensure that these are always modified\nconsistently, even if a fault is taken while reading the register data\nfrom the signal context. I do not expect any software to depend on the\nexact state restored when a fault is taken while reading the context.(CVE-2026-23102)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly.  It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border.  For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it\u0026apos;s very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section.  Also, ensure the order won\u0026apos;t\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here.  Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it).  So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem.  After applying this patch, all problems are gone.(CVE-2026-23161)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umad: Reject negative data_len in ib_umad_write\n\nib_umad_write computes data_len from user-controlled count and the\nMAD header sizes. With a mismatched user MAD header size and RMPP\nheader length, data_len can become negative and reach ib_create_send_mad().\nThis can make the padding calculation exceed the segment size and trigger\nan out-of-bounds memset in alloc_send_rmpp_list().\n\nAdd an explicit check to reject negative data_len before creating the\nsend buffer.\n\nKASAN splat:\n[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0\n[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102\n[  211.365867] ib_create_send_mad+0xa01/0x11b0\n[  211.365887] ib_umad_write+0x853/0x1c80(CVE-2026-23243)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix memory allocation in nvme_pr_read_keys()\n\nnvme_pr_read_keys() takes num_keys from userspace and uses it to\ncalculate the allocation size for rse via struct_size(). The upper\nlimit is PR_KEYS_MAX (64K).\n\nA malicious or buggy userspace can pass a large num_keys value that\nresults in a 4MB allocation attempt at most, causing a warning in\nthe page allocator when the order exceeds MAX_PAGE_ORDER.\n\nTo fix this, use kvzalloc() instead of kzalloc().\n\nThis bug has the same reasoning and fix with the patch below:\nhttps://lore.kernel.org/linux-block/(CVE-2026-23244)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set-\u0026gt;nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u0026gt;nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches.(CVE-2026-23272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: validate USB endpoints\n\nThe kaweth driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.(CVE-2026-23312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u0026gt;seqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n  iperf3 -ub0 -c $peer -t 0 \u0026amp;\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nWith KASAN enabled, this leads to reports like:\n\n  BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 1270 on cpu 5 at 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Freed by task 1306 on cpu 3 at 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u0026gt;seqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.(CVE-2026-23340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n  if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) \u0026gt; skb_in-\u0026gt;len)\n\nbut the second check omits it:\n\n  if ((sizeof(struct usb_cdc_ncm_ndp16) +\n       ret * (sizeof(struct usb_cdc_ncm_dpe16))) \u0026gt; skb_in-\u0026gt;len)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.(CVE-2026-23448)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2026-23473)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix krb5 mount with username option\n\nCustomer reported that some of their krb5 mounts were failing against\na single server as the client was trying to mount the shares with\nwrong credentials.  It turned out the client was reusing SMB session\nfrom first mount to try mounting the other shares, even though a\ndifferent username= option had been specified to the other mounts.\n\nBy using username mount option along with sec=krb5 to search for\nprincipals from keytab is supported by cifs.upcall(8) since\ncifs-utils-4.8.  So fix this by matching username mount option in\nmatch_session() even with Kerberos.\n\nFor example, the second mount below should fail with -ENOKEY as there\nis no \u0026apos;foobar\u0026apos; principal in keytab (/etc/krb5.keytab).  The client\nends up reusing SMB session from first mount to perform the second\none, which is wrong.\n\n```\n$ ktutil\nktutil:  add_entry -password -p testuser -k 1 -e aes256-cts\nPassword for (CVE-2026-31392)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix incorrect pte restoration for lazyfree folios\n\nWe batch unmap anonymous lazyfree folios by folio_unmap_pte_batch.  If the\nbatch has a mix of writable and non-writable bits, we may end up setting\nthe entire batch writable.  Fix this by respecting writable bit during\nbatching.\n\nAlthough on a successful unmap of a lazyfree folio, the soft-dirty bit is\nlost, preserve it on pte restoration by respecting the bit during\nbatching, to make the fix consistent w.r.t both writable bit and\nsoft-dirty bit.\n\nI was able to write the below reproducer and crash the kernel. \nExplanation of reproducer (set 64K mTHP to always):\n\nFault in a 64K large folio.  Split the VMA at mid-point with\nMADV_DONTFORK.  fork() - parent points to the folio with 8 writable ptes\nand 8 non-writable ptes.  Merge the VMAs with MADV_DOFORK so that\nfolio_unmap_pte_batch() can determine all the 16 ptes as a batch.  Do\nMADV_FREE on the range to mark the folio as lazyfree.  Write to the memory\nto dirty the pte, eventually rmap will dirty the folio.  Then trigger\nreclaim, we will hit the pte restoration path, and the kernel will crash\nwith the trace given below.\n\nThe BUG happens at:\n\n\tBUG_ON(atomic_inc_return(\u0026amp;ptc-\u0026gt;anon_map_count) \u0026gt; 1 \u0026amp;\u0026amp; rw);\n\nThe code path is asking for anonymous page to be mapped writable into the\npagetable.  The BUG_ON() firing implies that such a writable page has been\nmapped into the pagetables of more than one process, which breaks\nanonymous memory/CoW semantics.\n\n[   21.134473] kernel BUG at mm/page_table_check.c:118!\n[   21.134497] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[   21.135917] Modules linked in:\n[   21.136085] CPU: 1 UID: 0 PID: 1735 Comm: dup-lazyfree Not tainted 7.0.0-rc1-00116-g018018a17770 #1028 PREEMPT\n[   21.136858] Hardware name: linux,dummy-virt (DT)\n[   21.137019] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[   21.137308] pc : page_table_check_set+0x28c/0x2a8\n[   21.137607] lr : page_table_check_set+0x134/0x2a8\n[   21.137885] sp : ffff80008a3b3340\n[   21.138124] x29: ffff80008a3b3340 x28: fffffdffc3d14400 x27: ffffd1a55e03d000\n[   21.138623] x26: 0040000000000040 x25: ffffd1a55f7dd000 x24: 0000000000000001\n[   21.139045] x23: 0000000000000001 x22: 0000000000000001 x21: ffffd1a55f217f30\n[   21.139629] x20: 0000000000134521 x19: 0000000000134519 x18: 005c43e000040000\n[   21.140027] x17: 0001400000000000 x16: 0001700000000000 x15: 000000000000ffff\n[   21.140578] x14: 000000000000000c x13: 005c006000000000 x12: 0000000000000020\n[   21.140828] x11: 0000000000000000 x10: 005c000000000000 x9 : ffffd1a55c079ee0\n[   21.141077] x8 : 0000000000000001 x7 : 005c03e000040000 x6 : 000000004000ffff\n[   21.141490] x5 : ffff00017fffce00 x4 : 0000000000000001 x3 : 0000000000000002\n[   21.141741] x2 : 0000000000134510 x1 : 0000000000000000 x0 : ffff0000c08228c0\n[   21.141991] Call trace:\n[   21.142093]  page_table_check_set+0x28c/0x2a8 (P)\n[   21.142265]  __page_table_check_ptes_set+0x144/0x1e8\n[   21.142441]  __set_ptes_anysz.constprop.0+0x160/0x1a8\n[   21.142766]  contpte_set_ptes+0xe8/0x140\n[   21.142907]  try_to_unmap_one+0x10c4/0x10d0\n[   21.143177]  rmap_walk_anon+0x100/0x250\n[   21.143315]  try_to_unmap+0xa0/0xc8\n[   21.143441]  shrink_folio_list+0x59c/0x18a8\n[   21.143759]  shrink_lruvec+0x664/0xbf0\n[   21.144043]  shrink_node+0x218/0x878\n[   21.144285]  __node_reclaim.constprop.0+0x98/0x338\n[   21.144763]  user_proactive_reclaim+0x2a4/0x340\n[   21.145056]  reclaim_store+0x3c/0x60\n[   21.145216]  dev_attr_store+0x20/0x40\n[   21.145585]  sysfs_kf_write+0x84/0xa8\n[   21.145835]  kernfs_fop_write_iter+0x130/0x1c8\n[   21.145994]  vfs_write+0x2b8/0x368\n[   21.146119]  ksys_write+0x70/0x110\n[   21.146240]  __arm64_sys_write+0x24/0x38\n[   21.146380]  invoke_syscall+0x50/0x120\n[   21.146513]  el0_svc_common.constprop.0+0x48/0xf8\n[   21.146679]  do_el0_svc+0x28/0x40\n[   21.146798]  el0_svc+0x34/0x110\n[   21.146926]  el0t\n---truncated---(CVE-2026-31398)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_fw: fix NULL pointer dereference on shared blocks\n\nThe old-method path in fw_classify() calls tcf_block_q() and\ndereferences q-\u0026gt;handle.  Shared blocks leave block-\u0026gt;q NULL, causing a\nNULL deref when an empty cls_fw filter is attached to a shared block\nand a packet with a nonzero major skb mark is classified.\n\nReject the configuration in fw_change() when the old method (no\nTCA_OPTIONS) is used on a shared block, since fw_classify()\u0026apos;s\nold-method path needs block-\u0026gt;q which is NULL for shared blocks.\n\nThe fixed null-ptr-deref calling stack:\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:fw_classify (net/sched/cls_fw.c:81)\n Call Trace:\n  tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)\n  tc_run (net/core/dev.c:4401)\n  __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)(CVE-2026-31421)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: fix NULL pointer dereference on shared blocks\n\nflow_change() calls tcf_block_q() and dereferences q-\u0026gt;handle to derive\na default baseclass.  Shared blocks leave block-\u0026gt;q NULL, causing a NULL\nderef when a flow filter without a fully qualified baseclass is created\non a shared block.\n\nCheck tcf_block_shared() before accessing block-\u0026gt;q and return -EINVAL\nfor shared blocks.  This avoids the null-deref shown below:\n\n=======================================================================\nKASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\nRIP: 0010:flow_change (net/sched/cls_flow.c:508)\nCall Trace:\n tc_new_tfilter (net/sched/cls_api.c:2432)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)\n [...]\n=======================================================================(CVE-2026-31422)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb: fix cross-cache free of KFENCE-allocated skb head\n\nSKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2\nvalue (e.g. 704 on x86_64) to avoid collisions with generic kmalloc\nbucket sizes. This ensures that skb_kfree_head() can reliably use\nskb_end_offset to distinguish skb heads allocated from\nskb_small_head_cache vs. generic kmalloc caches.\n\nHowever, when KFENCE is enabled, kfence_ksize() returns the exact\nrequested allocation size instead of the slab bucket size. If a caller\n(e.g. bpf_test_init) allocates skb head data via kzalloc() and the\nrequested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then\nslab_build_skb() -\u0026gt; ksize() returns that exact value. After subtracting\nskb_shared_info overhead, skb_end_offset ends up matching\nSKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free\nthe object to skb_small_head_cache instead of back to the original\nkmalloc cache, resulting in a slab cross-cache free:\n\n  kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected\n  skbuff_small_head but got kmalloc-1k\n\nFix this by always calling kfree(head) in skb_kfree_head(). This keeps\nthe free path generic and avoids allocator-specific misclassification\nfor KFENCE objects.(CVE-2026-31429)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nX.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length.  Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list.(CVE-2026-31430)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released.(CVE-2026-31441)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it\u0026apos;s possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes.(CVE-2026-31442)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\u0026quot;ext4: fix bug_on in start_this_handle during umount\nfilesystem\u0026quot;) moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -\u0026gt; sysfs_notify() which\naccesses the kobject\u0026apos;s kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n  update_super_work                ext4_put_super\n  -----------------                --------------\n                                   ext4_unregister_sysfs(sb)\n                                     kobject_del(\u0026amp;sbi-\u0026gt;s_kobj)\n                                       __kobject_del()\n                                         sysfs_remove_dir()\n                                           kobj-\u0026gt;sd = NULL\n                                         sysfs_put(sd)\n                                           kernfs_put()  // RCU free\n  ext4_notify_error_sysfs(sbi)\n    sysfs_notify(\u0026amp;sbi-\u0026gt;s_kobj)\n      kn = kobj-\u0026gt;sd              // stale pointer\n      kernfs_get(kn)             // UAF on freed kernfs_node\n                                   ext4_journal_destroy()\n                                     flush_work(\u0026amp;sbi-\u0026gt;s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call.(CVE-2026-31446)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx-\u0026gt;ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.(CVE-2026-31449)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u0026gt;jinode to concurrent users.\nIt used to set ei-\u0026gt;jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u0026gt;i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u0026lt;49\u0026gt; 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u0026lt;TASK\u0026gt;\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u0026gt;jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer.(CVE-2026-31450)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption.(CVE-2026-31451)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u0026gt; inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0026apos;s actual\ninline capacity (EXT4_I(inode)-\u0026gt;i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.(CVE-2026-31452)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n  submit_bio                      //bio_list is initialized.\n    mmc_blk_mq_recovery\n      z_erofs_endio\n        vm_map_ram\n          __pte_alloc_kernel\n            __alloc_pages_direct_reclaim\n              shrink_folio_list\n                __swap_writepage\n                  submit_bio_wait  //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path.(CVE-2026-31467)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device\u0026apos;s IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb-\u0026gt;dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n  ...\n  percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n  dst_release+0xe0/0x110  net/core/dst.c:177\n  skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n  sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n  dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n  napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n  __free_old_xmit+0x164/0x230  drivers/net/virtio_net.c:611 [virtio_net]\n  free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n  start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n  ...\n\nReproduction Steps:\nNETDEV=\u0026quot;enp3s0\u0026quot;\n\nconfig_qdisc_route_filter() {\n    tc qdisc del dev $NETDEV root\n    tc qdisc add dev $NETDEV root handle 1: prio\n    tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n    ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n    ip netns add testns\n    ip link set $NETDEV netns testns\n    ip netns exec testns ifconfig $NETDEV  10.0.32.46/24\n    ip netns exec testns ping -c 1 10.0.32.1\n    ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns(CVE-2026-31469)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus\u0026apos; match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \u0026quot;\u0026quot; to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\u0026quot;\\n\u0026quot; instead of \u0026quot;(null)\\n\u0026quot;.(CVE-2026-31487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values \u0026gt; TCP_CONNTRACK_SYN_SENT2 at\n  policy level, removing the manual \u0026gt;= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values \u0026gt; TCP_MAX_WSCALE\n  (14). The normal TCP option parsing path already clamps to this value,\n  but the ctnetlink path accepted 0-255, causing undefined behavior when\n  used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n  CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n  a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree.(CVE-2026-31495)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\u0026quot;netfilter: conntrack: do not dump other netns\u0026apos;s\nconntrack entries via proc\u0026quot;).(CVE-2026-31496)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan-\u0026gt;sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard.(CVE-2026-31498)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn-\u0026gt;lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn-\u0026gt;lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn-\u0026gt;lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del().(CVE-2026-31499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\u0026quot;ethtool -L\u0026quot; and \u0026quot;ethtool -S\u0026quot; simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u0026gt; num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -\u0026gt; buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -\u0026gt; out-of-bounds!\n                            iavf_finish_config()\n                            -\u0026gt; real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  \u0026lt;/TASK\u0026gt;\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u0026gt;ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8(CVE-2026-31505)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __kasan_check_byte+0x12/0x40\n  lock_acquire+0x79/0x2e0\n  lock_sock_nested+0x48/0x100\n  ? l2cap_sock_ready_cb+0x46/0x160\n  l2cap_sock_ready_cb+0x46/0x160\n  l2cap_conn_start+0x779/0xff0\n  ? __pfx_l2cap_conn_start+0x10/0x10\n  ? l2cap_info_timeout+0x60/0xa0\n  ? __pfx___mutex_lock+0x10/0x10\n  l2cap_info_timeout+0x68/0xa0\n  ? process_scheduled_works+0xa8d/0x18c0\n  process_scheduled_works+0xb6e/0x18c0\n  ? __pfx_process_scheduled_works+0x10/0x10\n  ? assign_work+0x3d5/0x5e0\n  worker_thread+0xa53/0xfc0\n  kthread+0x388/0x470\n  ? __pfx_worker_thread+0x10/0x10\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x51e/0xb90\n  ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n  ? __switch_to+0xc7d/0x1450\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm \u0026apos;minstrel_ht\u0026apos;\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception(CVE-2026-31510)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory.(CVE-2026-31511)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() reads the SDU length field from skb-\u0026gt;data using\nget_unaligned_le16() without first verifying that skb contains at least\nL2CAP_SDULEN_SIZE (2) bytes. When skb-\u0026gt;len is less than 2, this reads\npast the valid data in the skb.\n\nThe ERTM reassembly path correctly calls pskb_may_pull() before reading\nthe SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the\nsame validation to the Enhanced Credit Based Flow Control data path.(CVE-2026-31512)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net.(CVE-2026-31516)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error.(CVE-2026-31518)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter\u0026apos;s signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier\u0026apos;s abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter\u0026apos;s sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs().(CVE-2026-31525)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx-\u0026gt;pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx-\u0026gt;pmu.\n\nTurns out, inherit uses event-\u0026gt;pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx-\u0026gt;pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx-\u0026gt;pmu for the\ngroup case.(CVE-2026-31528)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u0026gt;uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u0026gt;uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u0026gt;uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually](CVE-2026-31532)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\u0026quot;net: tls: handle backlogging of crypto requests\u0026quot;), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge-\u0026gt;offset, sge-\u0026gt;length) and decrements\nctx-\u0026gt;encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration.(CVE-2026-31533)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[   23.289926] PM: suspend entry (deep)\n[   23.293558] Filesystems sync: 0.000 seconds\n[   23.298010] Freezing user space processes\n[   23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[   23.309766] OOM killer disabled.\n[   23.313027] Freezing remaining freezable tasks\n[   23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[   23.342038] serial 00:05: disabled\n[   23.345719] serial 00:02: disabled\n[   23.349342] serial 00:01: disabled\n[   23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[   23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[   23.361635] ata1.00: Entering standby power mode\n[   23.368863] ata2.00: Entering standby power mode\n[   23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[   23.452194] #PF: supervisor instruction fetch in kernel mode\n[   23.457896] #PF: error_code(0x0010) - not-present page\n[   23.463065] PGD 0 P4D 0\n[   23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[   23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S      W           6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[   23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[   23.496511] Workqueue: async async_run_entry_fn\n[   23.501087] RIP: 0010:0x0\n[   23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[   23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[   23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[   23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[   23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[   23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[   23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[   23.551457] FS:  0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[   23.559588] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[   23.572539] PKRU: 55555554\n[   23.575281] Call Trace:\n[   23.577770]  \u0026lt;TASK\u0026gt;\n[   23.579905]  intel_engines_reset_default_submission+0x42/0x60\n[   23.585695]  __intel_gt_unset_wedged+0x191/0x200\n[   23.590360]  intel_gt_unset_wedged+0x20/0x40\n[   23.594675]  gt_sanitize+0x15e/0x170\n[   23.598290]  i915_gem_suspend_late+0x6b/0x180\n[   23.602692]  i915_drm_suspend_late+0x35/0xf0\n[   23.607008]  ? __pfx_pci_pm_suspend_late+0x10/0x10\n[   23.611843]  dpm_run_callback+0x78/0x1c0\n[   23.615817]  device_suspend_late+0xde/0x2e0\n[   23.620037]  async_suspend_late+0x18/0x30\n[   23.624082]  async_run_entry_fn+0x25/0xa0\n[   23.628129]  process_one_work+0x15b/0x380\n[   23.632182]  worker_thread+0x2a5/0x3c0\n[   23.635973]  ? __pfx_worker_thread+0x10/0x10\n[   23.640279]  kthread+0xf6/0x1f0\n[   23.643464]  ? __pfx_kthread+0x10/0x10\n[   23.647263]  ? __pfx_kthread+0x10/0x10\n[   23.651045]  ret_from_fork+0x131/0x190\n[   23.654837]  ? __pfx_kthread+0x10/0x10\n[   23.658634]  ret_from_fork_asm+0x1a/0x30\n[   23.662597]  \u0026lt;/TASK\u0026gt;\n[   23.664826] Modules linked in:\n[   23.667914] CR2: 0000000000000000\n[   23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)(CVE-2026-31540)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it\u0026apos;s mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes.(CVE-2026-31542)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info-\u0026gt;slave without checking if it\u0026apos;s NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info-\u0026gt;slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[    1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[    1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[    1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[    1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[    1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[    1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[    1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[    1.294864] FS:  0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[    1.295239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[    1.295897] Call Trace:\n[    1.296134]  seq_read_iter (fs/seq_file.c:231)\n[    1.296341]  seq_read (fs/seq_file.c:164)\n[    1.296493]  full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[    1.296658]  vfs_read (fs/read_write.c:572)\n[    1.296981]  ksys_read (fs/read_write.c:717)\n[    1.297132]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[    1.297325]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \u0026quot;(none)\u0026quot; for entries with no assigned slave.(CVE-2026-31546)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in \u0026apos;exiting\u0026apos;.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.(CVE-2026-31555)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory \u0026apos;f\u0026apos; (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)(CVE-2026-31566)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8-\u0026gt;from_idx, cf-\u0026gt;len);\n    int to   = calc_idx(crc8-\u0026gt;to_idx,   cf-\u0026gt;len);\n    int res  = calc_idx(crc8-\u0026gt;result_idx, cf-\u0026gt;len);\n\n    if (from \u0026lt; 0 || to \u0026lt; 0 || res \u0026lt; 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8-\u0026gt;from_idx; ...)        /* BUG: raw negative index */\n    cf-\u0026gt;data[crc8-\u0026gt;result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf-\u0026gt;data[-64], and the write goes to cf-\u0026gt;data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (\u0026lt;= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.(CVE-2026-31570)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, \u0026amp;range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \u0026quot;addr\u0026quot;\nand \u0026quot;size\u0026quot; are u64s and SEV is 64-bit only, i.e. they _can\u0026apos;t_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range-\u0026gt;addr \u0026gt; ULONG_MAX || range-\u0026gt;size \u0026gt; ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \u0026quot;hard\u0026quot; way, e.g. instead of just shifting @ulen.(CVE-2026-31590)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup\n\nDisable the delayed work before clearing BAR mappings and doorbells to\navoid running the handler after resources have been torn down.\n\n  Unable to handle kernel paging request at virtual address ffff800083f46004\n  [...]\n  Internal error: Oops: 0000000096000007 [#1]  SMP\n  [...]\n  Call trace:\n   epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n   process_one_work+0x154/0x3b0\n   worker_thread+0x2c8/0x400\n   kthread+0x148/0x210\n   ret_from_fork+0x10/0x20(CVE-2026-31595)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1\u0026apos;s hardware divider can leave, under certain circumstances, partial\nresults from previous operations.  Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit.(CVE-2026-31628)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \u0026quot;%pISpc\u0026quot;.\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n  [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter\u0026apos;s maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n  explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n  mapped-v4 example(CVE-2026-31630)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free.(CVE-2026-31651)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n  nf_conntrack_tcp_packet+0x1381/0x29d0\n  nf_conntrack_in+0x612/0x8b0\n  nf_hook_slow+0x70/0x100\n  __ip_local_out+0x1b2/0x210\n  tcp_sendmsg_locked+0x722/0x1580\n  __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n  nft_ct_timeout_obj_init+0xf6/0x290\n  nft_obj_init+0x107/0x1b0\n  nf_tables_newobj+0x680/0x9c0\n  nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n  nft_obj_destroy+0x3f/0xa0\n  nf_tables_trans_destroy_work+0x51c/0x5c0\n  process_one_work+0x2c4/0x5a0(CVE-2026-31665)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n  ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff-\u0026gt;mutex and calls\n   uinput_dev_upload_effect() -\u0026gt; uinput_request_submit() -\u0026gt;\n   uinput_request_send(), which acquires udev-\u0026gt;mutex.\n\n2. device create: uinput_ioctl_handler() holds udev-\u0026gt;mutex and calls\n   uinput_create_device() -\u0026gt; input_register_device(), which acquires\n   input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n   calls kbd_connect() -\u0026gt; input_register_handle(), which acquires\n   dev-\u0026gt;mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n   dev-\u0026gt;mutex, which calls input_ff_flush() acquiring ff-\u0026gt;mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev-\u0026gt;state and udev-\u0026gt;dev access in uinput_request_send() instead of\nacquiring udev-\u0026gt;mutex.  The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\nbreaks the ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev-\u0026gt;state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(\u0026amp;request-\u0026gt;done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot().  Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n  ff-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex (no back-edge)(CVE-2026-31667)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb-\u0026gt;data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb-\u0026gt;data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic.(CVE-2026-31675)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - limit RX SG extraction by receive buffer budget\n\nMake af_alg_get_rsgl() limit each RX scatterlist extraction to the\nremaining receive buffer budget.\n\naf_alg_get_rsgl() currently uses af_alg_readable() only as a gate\nbefore extracting data into the RX scatterlist. Limit each extraction\nto the remaining af_alg_rcvbuf(sk) budget so that receive-side\naccounting matches the amount of data attached to the request.\n\nIf skcipher cannot obtain enough RX space for at least one chunk while\nmore data remains to be processed, reject the recvmsg call instead of\nrounding the request length down to zero.(CVE-2026-31677)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u0026gt;dev.\n\nDo not release vport-\u0026gt;dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.(CVE-2026-31678)\n\nIn the Linux kernel, a memory out-of-bounds access vulnerability exists in the act_csum module\u0026apos;s tcf_csum_act() function when processing nested VLAN headers. When an skb still carries in-payload VLAN tags, the function walks nested VLAN headers directly from skb-\u0026gt;data. The current code reads vlan-\u0026gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.(CVE-2026-31684)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par-\u0026gt;fragoff != 0`. For packets with `par-\u0026gt;fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par-\u0026gt;fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`.(CVE-2026-31685)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/mc: Fix error path ordering in edac_mc_alloc()\n\nWhen the mci-\u0026gt;pvt_info allocation in edac_mc_alloc() fails, the error path\nwill call put_device() which will end up calling the device\u0026apos;s release\nfunction.\n\nHowever, the init ordering is wrong such that device_initialize() happens\n*after* the failed allocation and thus the device itself and the release\nfunction pointer are not initialized yet when they\u0026apos;re called:\n\n  MCE: In-kernel MCE decoding enabled.\n  ------------[ cut here ]------------\n  kobject: \u0026apos;(null)\u0026apos;: is not initialized, yet kobject_put() is being called.\n  WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n  CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n  RIP: 0010:kobject_put\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   edac_mc_alloc+0xbe/0xe0 [edac_core]\n   amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n   ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n   do_one_initcall\n   ...\n\nReorder the calling sequence so that the device is initialized and thus the\nrelease function pointer is properly set before it can be used.\n\nThis was found by Claude while reviewing another EDAC patch.(CVE-2026-31689)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don\u0026apos;t attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don\u0026apos;t attempt to copy the blobs to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31698)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don\u0026apos;t attempt to copy the blob to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31699)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp-\u0026gt;Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds.(CVE-2026-31708)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31738)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep-\u0026gt;desc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep-\u0026gt;desc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready.(CVE-2026-31755)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026amp;hdev-\u0026gt;lock) and add\nlockdep_assert_held(\u0026amp;hdev-\u0026gt;lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt().(CVE-2026-31771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated.(CVE-2026-31773)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif-\u0026gt;matches is at least\nas large as the number of bytes to copy. Otherwise, results-\u0026gt;matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2026-31779)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list.(CVE-2026-31781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.(CVE-2026-43020)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: use skb_header_pointer() for TCPv4 GSO frag_off check\n\nSyzbot reported a KMSAN uninit-value warning in gso_features_check()\ncalled from netif_skb_features() [1].\n\ngso_features_check() reads iph-\u0026gt;frag_off to decide whether to clear\nmangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()\ncan rely on skb header offsets that are not always safe for direct\ndereference on packets injected from PF_PACKET paths.\n\nUse skb_header_pointer() for the TCPv4 frag_off check so the header read\nis robust whether data is already linear or needs copying.\n\n[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407(CVE-2026-43036)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.(CVE-2026-43040)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL\u0026apos;s last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl().(CVE-2026-43043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed.(CVE-2026-43064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Skip discovery table for offline dies\n\nThis warning can be triggered if NUMA is disabled and the system\nboots with fewer CPUs than the number of CPUs in die 0.\n\nWARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nCurrently, the discovery table continues to be parsed even if all CPUs\nin the associated die are offline.  This can lead to an array overflow\nat \u0026quot;pmu-\u0026gt;boxes[die] = box\u0026quot; in uncore_pci_pmu_register(), which may\ntrigger the warning above or cause other issues.(CVE-2026-43079)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/smp: Add check for kcalloc() failure in parse_thread_groups()\n\nAs kcalloc() may fail, check its return value to avoid a NULL pointer\ndereference when passing it to of_property_read_u32_array().(CVE-2026-43148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE\n\nThe arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE -\nwhich is a valid index - so add a check for this.(CVE-2026-43212)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fiemap page fault fix\n\nIn gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode\nglock.  This can lead to recursive glock taking if the fiemap buffer is\nmemory mapped to the same inode and accessing it triggers a page fault.\n\nFix by disabling page faults for iomap_fiemap() and faulting in the\nbuffer by hand if necessary.\n\nFixes xfstest generic/742.(CVE-2026-43262)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: supply snapshot context in ceph_zero_partial_object()\n\nThe ceph_zero_partial_object function was missing proper snapshot\ncontext for its OSD write operations, which could lead to data\ninconsistencies in snapshots.\n\nReproducer:\n../src/vstart.sh --new -x --localhost --bluestore\n./bin/ceph auth caps client.fs_a mds \u0026apos;allow rwps fsname=a\u0026apos; mon \u0026apos;allow r fsname=a\u0026apos; osd \u0026apos;allow rw tag cephfs data=a\u0026apos;\nmount -t ceph (CVE-2026-43273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.(CVE-2026-43345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix memory leaks in ceph_mdsc_build_path()\n\nAdd __putname() calls to error code paths that did not free the \u0026quot;path\u0026quot;\npointer obtained by __getname().  If ownership of this pointer is not\npassed to the caller via path_info.path, the function must free it\nbefore returning.(CVE-2026-43419)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations.  And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts.  The limit chosen here, somewhat\narbitrarily, is 60 seconds.  On many systems (although not all) this\nis short enough to avoid triggering the kernel\u0026apos;s hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout.(CVE-2026-43428)\n\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: pcrypt - Fix handling of MAY_BACKLOG requests  MAY_BACKLOG requests can return EBUSY.  Handle them by checking for that value and filtering out EINPROGRESS notifications.  The Linux kernel CVE team has assigned CVE-2026-43493 to this issue.(CVE-2026-43493)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u0026gt;flags when\nmoving frags from source to destination.  __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u0026gt;flags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched.  As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data().  ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0026apos;dup to \u0026lt;local\u0026gt;\u0026apos; rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0026apos;d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source.  skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0026apos;s frag descriptors into the\naccumulator\u0026apos;s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0026apos;s frag_list.  Downstream skb_segment() reads only\nskb_shinfo(p)-\u0026gt;flags, and skb_segment_list() reuses each sub-skb\u0026apos;s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb.  The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0026apos;s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0026apos;s flag into nskb.  Fold frag_skb\u0026apos;s flag at both sites\nso segments drawing frags from frag_list members carry the marker.(CVE-2026-43503)","status":"published","published":"2026-06-05T11:11:31Z","modified":"2026-08-18T01:20:04.18419257Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2582","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitialized timer\n\nWith CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads\nto the following splat:\n\n[  250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0\n[  250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0\n[  250.218775] Modules linked in: hfcpci(-) mISDN_core\n[  250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary)\n[  250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0\n[  250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d\n[  250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286\n[  250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95\n[  250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0\n[  250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39\n[  250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001\n[  250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8\n[  250.232454] FS:  00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000\n[  250.233851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0\n[  250.236117] Call Trace:\n[  250.236599]  \u0026lt;TASK\u0026gt;\n[  250.236967]  ? trace_irq_enable.constprop.0+0xd4/0x130\n[  250.237920]  debug_object_assert_init+0x1f6/0x310\n[  250.238762]  ? __pfx_debug_object_assert_init+0x10/0x10\n[  250.239658]  ? __lock_acquire+0xdea/0x1c70\n[  250.240369]  __try_to_del_timer_sync+0x69/0x140\n[  250.241172]  ? __pfx___try_to_del_timer_sync+0x10/0x10\n[  250.242058]  ? __timer_delete_sync+0xc6/0x120\n[  250.242842]  ? lock_acquire+0x30/0x80\n[  250.243474]  ? __timer_delete_sync+0xc6/0x120\n[  250.244262]  __timer_delete_sync+0x98/0x120\n[  250.245015]  HFC_cleanup+0x10/0x20 [hfcpci]\n[  250.245704]  __do_sys_delete_module+0x348/0x510\n[  250.246461]  ? __pfx___do_sys_delete_module+0x10/0x10\n[  250.247338]  do_syscall_64+0xc1/0x360\n[  250.247924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by initializing hfc_tl timer with DEFINE_TIMER macro.\nAlso, use mod_timer instead of manual timeout update.(CVE-2025-39833)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Add support for Van Gogh SoC\n\nThe ROG Xbox Ally (non-X) SoC features a similar architecture to the\nSteam Deck. While the Steam Deck supports S3 (s2idle causes a crash),\nthis support was dropped by the Xbox Ally which only S0ix suspend.\n\nSince the handler is missing here, this causes the device to not suspend\nand the AMD GPU driver to crash while trying to resume afterwards due to\na power hang.(CVE-2025-68334)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops-\u0026gt;create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n  - If port_dev is not the same type as dev, dev takes mtu from port_dev\n  - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev-\u0026gt;mtu = dev-\u0026gt;mtu and instead\nletting team_dev_type_check_change assign dev-\u0026gt;mtu = port_dev-\u0026gt;mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n  - team device driver in-tree selftests\n  - Add/remove various devices as slaves of team device\n  - syzbot(CVE-2025-68340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_router: Fix neighbour use-after-free\n\nWe sometimes observe use-after-free when dereferencing a neighbour [1].\nThe problem seems to be that the driver stores a pointer to the\nneighbour, but without holding a reference on it. A reference is only\ntaken when the neighbour is used by a nexthop.\n\nFix by simplifying the reference counting scheme. Always take a\nreference when storing a neighbour pointer in a neighbour entry. Avoid\ntaking a referencing when the neighbour is used by a nexthop as the\nneighbour entry associated with the nexthop already holds a reference.\n\nTested by running the test that uncovered the problem over 300 times.\nWithout this patch the problem was reproduced after a handful of\niterations.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310\nRead of size 8 at addr ffff88817f8e3420 by task ip/3929\n\nCPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x6f/0xa0\n print_address_description.constprop.0+0x6e/0x300\n print_report+0xfc/0x1fb\n kasan_report+0xe4/0x110\n mlxsw_sp_neigh_entry_update+0x2d4/0x310\n mlxsw_sp_router_rif_gone_sync+0x35f/0x510\n mlxsw_sp_rif_destroy+0x1ea/0x730\n mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0\n __mlxsw_sp_inetaddr_lag_event+0xcc/0x130\n __mlxsw_sp_inetaddr_event+0xf5/0x3c0\n mlxsw_sp_router_netdevice_event+0x1015/0x1580\n notifier_call_chain+0xcc/0x150\n call_netdevice_notifiers_info+0x7e/0x100\n __netdev_upper_dev_unlink+0x10b/0x210\n netdev_upper_dev_unlink+0x79/0xa0\n vrf_del_slave+0x18/0x50\n do_set_master+0x146/0x7d0\n do_setlink.isra.0+0x9a0/0x2880\n rtnl_newlink+0x637/0xb20\n rtnetlink_rcv_msg+0x6fe/0xb90\n netlink_rcv_skb+0x123/0x380\n netlink_unicast+0x4a3/0x770\n netlink_sendmsg+0x75b/0xc90\n __sock_sendmsg+0xbe/0x160\n ____sys_sendmsg+0x5b2/0x7d0\n ___sys_sendmsg+0xfd/0x180\n __sys_sendmsg+0x124/0x1c0\n do_syscall_64+0xbb/0xfd0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[...]\n\nAllocated by task 109:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x2c1/0x790\n neigh_alloc+0x6af/0x8f0\n ___neigh_create+0x63/0xe90\n mlxsw_sp_nexthop_neigh_init+0x430/0x7e0\n mlxsw_sp_nexthop_type_init+0x212/0x960\n mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280\n mlxsw_sp_nexthop6_group_get+0x392/0x6a0\n mlxsw_sp_fib6_entry_create+0x46a/0xfd0\n mlxsw_sp_router_fib6_replace+0x1ed/0x5f0\n mlxsw_sp_router_fib6_event_work+0x10a/0x2a0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nFreed by task 154:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free_bulk.part.0+0x1eb/0x5e0\n kvfree_rcu_bulk+0x1f2/0x260\n kfree_rcu_work+0x130/0x1b0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nLast potentially related work creation:\n kasan_save_stack+0x30/0x50\n kasan_record_aux_stack+0x8c/0xa0\n kvfree_call_rcu+0x93/0x5b0\n mlxsw_sp_router_neigh_event_work+0x67d/0x860\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20(CVE-2025-68801)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u0026gt;rq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.(CVE-2025-71068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\u0026quot;i40evf: Allow PF driver to configure RSS\u0026quot;),\nthe loop upper bounds were:\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u0026lt;=`\naccesses one element past the end.\n\nFix the issues by using `\u0026lt;` instead of `\u0026lt;=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc(CVE-2025-71087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer\n\nInitialize the eb.vma array with values of 0 when the eb structure is\nfirst set up. In particular, this sets the eb-\u0026gt;vma[i].vma pointers to\nNULL, simplifying cleanup and getting rid of the bug described below.\n\nDuring the execution of eb_lookup_vmas(), the eb-\u0026gt;vma array is\nsuccessively filled up with struct eb_vma objects. This process includes\ncalling eb_add_vma(), which might fail; however, even in the event of\nfailure, eb-\u0026gt;vma[i].vma is set for the currently processed buffer.\n\nIf eb_add_vma() fails, eb_lookup_vmas() returns with an error, which\nprompts a call to eb_release_vmas() to clean up the mess. Since\neb_lookup_vmas() might fail during processing any (possibly not first)\nbuffer, eb_release_vmas() checks whether a buffer\u0026apos;s vma is NULL to know\nat what point did the lookup function fail.\n\nIn eb_lookup_vmas(), eb-\u0026gt;vma[i].vma is set to NULL if either the helper\nfunction eb_lookup_vma() or eb_validate_vma() fails. eb-\u0026gt;vma[i+1].vma is\nset to NULL in case i915_gem_object_userptr_submit_init() fails; the\ncurrent one needs to be cleaned up by eb_release_vmas() at this point,\nso the next one is set. If eb_add_vma() fails, neither the current nor\nthe next vma is set to NULL, which is a source of a NULL deref bug\ndescribed in the issue linked in the Closes tag.\n\nWhen entering eb_lookup_vmas(), the vma pointers are set to the slab\npoison value, instead of NULL. This doesn\u0026apos;t matter for the actual\nlookup, since it gets overwritten anyway, however the eb_release_vmas()\nfunction only recognizes NULL as the stopping value, hence the pointers\nare being set to NULL as they go in case of intermediate failure. This\npatch changes the approach to filling them all with NULL at the start\ninstead, rather than handling that manually during failure.\n\n(cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd)(CVE-2025-71130)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: properly keep track of conduit reference\n\nProblem description\n-------------------\n\nDSA has a mumbo-jumbo of reference handling of the conduit net device\nand its kobject which, sadly, is just wrong and doesn\u0026apos;t make sense.\n\nThere are two distinct problems.\n\n1. The OF path, which uses of_find_net_device_by_node(), never releases\n   the elevated refcount on the conduit\u0026apos;s kobject. Nominally, the OF and\n   non-OF paths should result in objects having identical reference\n   counts taken, and it is already suspicious that\n   dsa_dev_to_net_device() has a put_device() call which is missing in\n   dsa_port_parse_of(), but we can actually even verify that an issue\n   exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command\n   \u0026quot;before\u0026quot; and \u0026quot;after\u0026quot; applying this patch:\n\n(unbind the conduit driver for net device eno2)\necho 0000:00:00.2 \u0026gt; /sys/bus/pci/drivers/fsl_enetc/unbind\n\nwe see these lines in the output diff which appear only with the patch\napplied:\n\nkobject: \u0026apos;eno2\u0026apos; (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)\nkobject: \u0026apos;109\u0026apos; (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)\n\n2. After we find the conduit interface one way (OF) or another (non-OF),\n   it can get unregistered at any time, and DSA remains with a long-lived,\n   but in this case stale, cpu_dp-\u0026gt;conduit pointer. Holding the net\n   device\u0026apos;s underlying kobject isn\u0026apos;t actually of much help, it just\n   prevents it from being freed (but we never need that kobject\n   directly). What helps us to prevent the net device from being\n   unregistered is the parallel netdev reference mechanism (dev_hold()\n   and dev_put()).\n\nActually we actually use that netdev tracker mechanism implicitly on\nuser ports since commit 2f1e8ea726e9 (\u0026quot;net: dsa: link interfaces with\nthe DSA master to get rid of lockdep warnings\u0026quot;), via netdev_upper_dev_link().\nBut time still passes at DSA switch probe time between the initial\nof_find_net_device_by_node() code and the user port creation time, time\nduring which the conduit could unregister itself and DSA wouldn\u0026apos;t know\nabout it.\n\nSo we have to run of_find_net_device_by_node() under rtnl_lock() to\nprevent that from happening, and release the lock only with the netdev\ntracker having acquired the reference.\n\nDo we need to keep the reference until dsa_unregister_switch() /\ndsa_switch_shutdown()?\n1: Maybe yes. A switch device will still be registered even if all user\n   ports failed to probe, see commit 86f8b1c01a0a (\u0026quot;net: dsa: Do not\n   make user port errors fatal\u0026quot;), and the cpu_dp-\u0026gt;conduit pointers\n   remain valid.  I haven\u0026apos;t audited all call paths to see whether they\n   will actually use the conduit in lack of any user port, but if they\n   do, it seems safer to not rely on user ports for that reference.\n2. Definitely yes. We support changing the conduit which a user port is\n   associated to, and we can get into a situation where we\u0026apos;ve moved all\n   user ports away from a conduit, thus no longer hold any reference to\n   it via the net device tracker. But we shouldn\u0026apos;t let it go nonetheless\n   - see the next change in relation to dsa_tree_find_first_conduit()\n   and LAG conduits which disappear.\n   We have to be prepared to return to the physical conduit, so the CPU\n   port must explicitly keep another reference to it. This is also to\n   say: the user ports and their CPU ports may not always keep a\n   reference to the same conduit net device, and both are needed.\n\nAs for the conduit\u0026apos;s kobject for the /sys/class/net/ entry, we don\u0026apos;t\ncare about it, we can release it as soon as we hold the net device\nobject itself.\n\nHistory and blame attribution\n-----------------------------\n\nThe code has been refactored so many times, it is very difficult to\nfollow and properly attribute a blame, but I\u0026apos;ll try to make a short\nhistory which I hope to be correct.\n\nWe have two distinct probing paths:\n- one for OF, introduced in 2016 i\n---truncated---(CVE-2025-71152)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock in wait_current_trans() due to ignored transaction type\n\nWhen wait_current_trans() is called during start_transaction(), it\ncurrently waits for a blocked transaction without considering whether\nthe given transaction type actually needs to wait for that particular\ntransaction state. The btrfs_blocked_trans_types[] array already defines\nwhich transaction types should wait for which transaction states, but\nthis check was missing in wait_current_trans().\n\nThis can lead to a deadlock scenario involving two transactions and\npending ordered extents:\n\n  1. Transaction A is in TRANS_STATE_COMMIT_DOING state\n\n  2. A worker processing an ordered extent calls start_transaction()\n     with TRANS_JOIN\n\n  3. join_transaction() returns -EBUSY because Transaction A is in\n     TRANS_STATE_COMMIT_DOING\n\n  4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes\n\n  5. A new Transaction B is created (TRANS_STATE_RUNNING)\n\n  6. The ordered extent from step 2 is added to Transaction B\u0026apos;s\n     pending ordered extents\n\n  7. Transaction B immediately starts commit by another task and\n     enters TRANS_STATE_COMMIT_START\n\n  8. The worker finally reaches wait_current_trans(), sees Transaction B\n     in TRANS_STATE_COMMIT_START (a blocked state), and waits\n     unconditionally\n\n  9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START\n     according to btrfs_blocked_trans_types[]\n\n  10. Transaction B is waiting for pending ordered extents to complete\n\n  11. Deadlock: Transaction B waits for ordered extent, ordered extent\n      waits for Transaction B\n\nThis can be illustrated by the following call stacks:\n  CPU0                              CPU1\n                                    btrfs_finish_ordered_io()\n                                      start_transaction(TRANS_JOIN)\n                                        join_transaction()\n                                          # -EBUSY (Transaction A is\n                                          # TRANS_STATE_COMMIT_DOING)\n  # Transaction A completes\n  # Transaction B created\n  # ordered extent added to\n  # Transaction B\u0026apos;s pending list\n  btrfs_commit_transaction()\n    # Transaction B enters\n    # TRANS_STATE_COMMIT_START\n    # waiting for pending ordered\n    # extents\n                                        wait_current_trans()\n                                          # waits for Transaction B\n                                          # (should not wait!)\n\nTask bstore_kv_sync in btrfs_commit_transaction waiting for ordered\nextents:\n\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  btrfs_commit_transaction+0xbf7/0xda0 [btrfs]\n  btrfs_sync_file+0x342/0x4d0 [btrfs]\n  __x64_sys_fdatasync+0x4b/0x80\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nTask kworker in wait_current_trans waiting for transaction commit:\n\n  Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs]\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  wait_current_trans+0xb0/0x110 [btrfs]\n  start_transaction+0x346/0x5b0 [btrfs]\n  btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs]\n  btrfs_work_helper+0xe8/0x350 [btrfs]\n  process_one_work+0x1d3/0x3c0\n  worker_thread+0x4d/0x3e0\n  kthread+0x12d/0x150\n  ret_from_fork+0x1f/0x30\n\nFix this by passing the transaction type to wait_current_trans() and\nchecking btrfs_blocked_trans_types[cur_trans-\u0026gt;state] against the given\ntype before deciding to wait. This ensures that transaction types which\nare allowed to join during certain blocked states will not unnecessarily\nwait and cause deadlocks.(CVE-2025-71194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)-\u0026gt;vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry-\u0026gt;vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/(CVE-2026-23001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\u0026quot;ip6_gre: make ip6gre_header() robust\u0026quot;)\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246(CVE-2026-23011)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: prevent pcp corruption with SMP=n\n\nThe kernel test robot has reported:\n\n BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28\n  lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT  8cc09ef94dcec767faa911515ce9e609c45db470\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  __dump_stack (lib/dump_stack.c:95)\n  dump_stack_lvl (lib/dump_stack.c:123)\n  dump_stack (lib/dump_stack.c:130)\n  spin_dump (kernel/locking/spinlock_debug.c:71)\n  do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)\n  _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)\n  __free_frozen_pages (mm/page_alloc.c:2973)\n  ___free_pages (mm/page_alloc.c:5295)\n  __free_pages (mm/page_alloc.c:5334)\n  tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)\n  ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)\n  ? rcu_core (kernel/rcu/tree.c:?)\n  rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)\n  rcu_core_si (kernel/rcu/tree.c:2879)\n  handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)\n  __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)\n  irq_exit_rcu (kernel/softirq.c:741)\n  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)\n  free_pcppages_bulk (mm/page_alloc.c:1494)\n  drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)\n  __drain_all_pages (mm/page_alloc.c:2731)\n  drain_all_pages (mm/page_alloc.c:2747)\n  kcompactd (mm/compaction.c:3115)\n  kthread (kernel/kthread.c:465)\n  ? __cfi_kcompactd (mm/compaction.c:3166)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork (arch/x86/kernel/process.c:164)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\n  \u0026lt;/TASK\u0026gt;\n\nMatthew has analyzed the report and identified that in drain_page_zone()\nwe are in a section protected by spin_lock(\u0026amp;pcp-\u0026gt;lock) and then get an\ninterrupt that attempts spin_trylock() on the same lock.  The code is\ndesigned to work this way without disabling IRQs and occasionally fail the\ntrylock with a fallback.  However, the SMP=n spinlock implementation\nassumes spin_trylock() will always succeed, and thus it\u0026apos;s normally a\nno-op.  Here the enabled lock debugging catches the problem, but otherwise\nit could cause a corruption of the pcp structure.\n\nThe problem has been introduced by commit 574907741599 (\u0026quot;mm/page_alloc:\nleave IRQs enabled for per-cpu page allocations\u0026quot;).  The pcp locking scheme\nrecognizes the need for disabling IRQs to prevent nesting spin_trylock()\nsections on SMP=n, but the need to prevent the nesting in spin_lock() has\nnot been recognized.  Fix it by introducing local wrappers that change the\nspin_lock() to spin_lock_iqsave() with SMP=n and use them in all places\nthat do spin_lock(\u0026amp;pcp-\u0026gt;lock).\n\n[(CVE-2026-23025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc-\u0026gt;rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.(CVE-2026-23054)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim \u0026lt;(CVE-2026-23074)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb_pmd_shared()\n\nPatch series \u0026quot;mm/hugetlb: fixes for PMD table sharing (incl.  using\nmmu_gather)\u0026quot;, v3.\n\nOne functional fix, one performance regression fix, and two related\ncomment fixes.\n\nI cleaned up my prototype I recently shared [1] for the performance fix,\ndeferring most of the cleanups I had in the prototype to a later point. \nWhile doing that I identified the other things.\n\nThe goal of this patch set is to be backported to stable trees \u0026quot;fairly\u0026quot;\neasily. At least patch #1 and #4.\n\nPatch #1 fixes hugetlb_pmd_shared() not detecting any sharing\nPatch #2 + #3 are simple comment fixes that patch #4 interacts with.\nPatch #4 is a fix for the reported performance regression due to excessive\nIPI broadcasts during fork()+exit().\n\nThe last patch is all about TLB flushes, IPIs and mmu_gather.\nRead: complicated\n\nThere are plenty of cleanups in the future to be had + one reasonable\noptimization on x86. But that\u0026apos;s all out of scope for this series.\n\nRuntime tested, with a focus on fixing the performance regression using\nthe original reproducer [2] on x86.\n\n\nThis patch (of 4):\n\nWe switched from (wrongly) using the page count to an independent shared\ncount.  Now, shared page tables have a refcount of 1 (excluding\nspeculative references) and instead use ptdesc-\u0026gt;pt_share_count to identify\nsharing.\n\nWe didn\u0026apos;t convert hugetlb_pmd_shared(), so right now, we would never\ndetect a shared PMD table as such, because sharing/unsharing no longer\ntouches the refcount of a PMD table.\n\nPage migration, like mbind() or migrate_pages() would allow for migrating\nfolios mapped into such shared PMD tables, even though the folios are not\nexclusive.  In smaps we would account them as \u0026quot;private\u0026quot; although they are\n\u0026quot;shared\u0026quot;, and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the\npagemap interface.\n\nFix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().(CVE-2026-23100)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.(CVE-2026-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: secure_seq: add back ports to TS offset\n\nThis reverts 28ee1b746f49 (\u0026quot;secure_seq: downgrade to per-host timestamp offsets\u0026quot;)\n\ntcp_tw_recycle went away in 2017.\n\nZhouyan Deng reported off-path TCP source port leakage via\nSYN cookie side-channel that can be fixed in multiple ways.\n\nOne of them is to bring back TCP ports in TS offset randomization.\n\nAs a bonus, we perform a single siphash() computation\nto provide both an ISN and a TS offset.(CVE-2026-23247)\n\nIn the Linux kernel, a vulnerability exists in the AppArmor module\u0026apos;s unpack_pdb function. The vulnerability occurs due to failure to validate that DFA start states are within bounds, which can lead to out-of-bound reads. An attacker can exploit this vulnerability through specially crafted policy files, potentially leading to information disclosure or system crashes.(CVE-2026-23269)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set-\u0026gt;nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u0026gt;nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches.(CVE-2026-23272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: validate USB endpoints\n\nThe kaweth driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.(CVE-2026-23312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u0026gt;seqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n  iperf3 -ub0 -c $peer -t 0 \u0026amp;\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nWith KASAN enabled, this leads to reports like:\n\n  BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 1270 on cpu 5 at 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Freed by task 1306 on cpu 3 at 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u0026gt;seqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.(CVE-2026-23340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[  138.423369][    C1] ==================================================================\n[  138.424317][    C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.424906][    C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[  138.425778][    C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[  138.425795][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[  138.425800][    C1] Call Trace:\n[  138.425804][    C1]  \u0026lt;IRQ\u0026gt;\n[  138.425808][    C1]  dump_stack_lvl (lib/dump_stack.c:122)\n[  138.425828][    C1]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[  138.425839][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425844][    C1]  ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[  138.425853][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425859][    C1]  kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[  138.425868][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425878][    C1]  kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[  138.425884][    C1]  __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[  138.425889][    C1]  ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425893][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[  138.425898][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425903][    C1]  ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[  138.425910][    C1]  ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[  138.425916][    C1]  ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[  138.425921][    C1]  ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[  138.425927][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425931][    C1]  tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.(CVE-2026-23378)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix memory leak in ice_set_ringparam()\n\nIn ice_set_ringparam, tx_rings and xdp_rings are allocated before\nrx_rings. If the allocation of rx_rings fails, the code jumps to\nthe done label leaking both tx_rings and xdp_rings. Furthermore, if\nthe setup of an individual Rx ring fails during the loop, the code jumps\nto the free_tx label which releases tx_rings but leaks xdp_rings.\n\nFix this by introducing a free_xdp label and updating the error paths to\nensure both xdp_rings and tx_rings are properly freed if rx_rings\nallocation or setup fails.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.(CVE-2026-23389)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[   94.984676] ==================================================================\n[   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[   94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   94.986329] Call Trace:\n[   94.986341]  \u0026lt;TASK\u0026gt;\n[   94.986347]  dump_stack_lvl+0x5e/0x80\n[   94.986374]  print_report+0xc8/0x270\n[   94.986384]  ? aa_dfa_match+0x5ae/0x760\n[   94.986388]  kasan_report+0x118/0x150\n[   94.986401]  ? aa_dfa_match+0x5ae/0x760\n[   94.986405]  aa_dfa_match+0x5ae/0x760\n[   94.986408]  __aa_path_perm+0x131/0x400\n[   94.986418]  aa_path_perm+0x219/0x2f0\n[   94.986424]  apparmor_file_open+0x345/0x570\n[   94.986431]  security_file_open+0x5c/0x140\n[   94.986442]  do_dentry_open+0x2f6/0x1120\n[   94.986450]  vfs_open+0x38/0x2b0\n[   94.986453]  ? may_open+0x1e2/0x2b0\n[   94.986466]  path_openat+0x231b/0x2b30\n[   94.986469]  ? __x64_sys_openat+0xf8/0x130\n[   94.986477]  do_file_open+0x19d/0x360\n[   94.986487]  do_sys_openat2+0x98/0x100\n[   94.986491]  __x64_sys_openat+0xf8/0x130\n[   94.986499]  do_syscall_64+0x8e/0x660\n[   94.986515]  ? count_memcg_events+0x15f/0x3c0\n[   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986540]  ? handle_mm_fault+0x1639/0x1ef0\n[   94.986551]  ? vma_start_read+0xf0/0x320\n[   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0\n[   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986588]  ? irqentry_exit+0x3c/0x590\n[   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.(CVE-2026-23406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u0026gt;= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[   57.179855] ==================================================================\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   57.181563] Call Trace:\n[   57.181572]  \u0026lt;TASK\u0026gt;\n[   57.181577]  dump_stack_lvl+0x5e/0x80\n[   57.181596]  print_report+0xc8/0x270\n[   57.181605]  ? verify_dfa+0x59a/0x660\n[   57.181608]  kasan_report+0x118/0x150\n[   57.181620]  ? verify_dfa+0x59a/0x660\n[   57.181623]  verify_dfa+0x59a/0x660\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\n[   57.181640]  unpack_pdb+0x86d/0x46b0\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\n[   57.181659]  aa_unpack+0x20b0/0x4c30\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\n[   57.181681]  ? kasan_save_track+0x4f/0x80\n[   57.181683]  ? kasan_save_track+0x3e/0x80\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\n[   57.181697]  ? policy_update+0x154/0x330\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181717]  ? _copy_from_user+0x2a/0x70\n[   57.181730]  policy_update+0x17a/0x330\n[   57.181733]  profile_replace+0x153/0x1a0\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\n[   57.181740]  vfs_write+0x235/0xab0\n[   57.181745]  ksys_write+0xb0/0x170\n[   57.181748]  do_syscall_64+0x8e/0x660\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.(CVE-2026-23407)\n\nA race condition vulnerability exists in the AppArmor security module of the Linux kernel, leading to a use-after-free issue. This vulnerability can be triggered when an attacker simultaneously opens rawdata files and removes an associated AppArmor profile. Since rawdata inodes are not refcounted, there is a time window during profile removal where the i_private pointer may reference freed memory, causing the system to access freed memory regions. This can result in program crashes, unexpected value usage, or arbitrary code execution, threatening the confidentiality, integrity, and availability of the system.(CVE-2026-23410)\n\nA vulnerability exists in the AppArmor security module of the Linux kernel when handling the i_private field of the inode structure. AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can and does live beyond that point and it is possible that some of the fs callback functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. This vulnerability could allow a local attacker to bypass AppArmor\u0026apos;s access control policies through a specially crafted request, leading to privilege escalation and impacting system confidentiality, integrity, and availability.(CVE-2026-23411)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n  [...]\n  Call Trace:\n    \u0026lt;TASK\u0026gt;\n    genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n    genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n    [...]\n    netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n    genl_rcv (net/netlink/genetlink.c:1219)\n    netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n    netlink_sendmsg (net/netlink/af_netlink.c:1894)\n    __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n    __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n    __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n    do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n    entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it.(CVE-2026-23439)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel\u0026apos;s xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there\u0026apos;s no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow.(CVE-2026-23440)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent concurrent access to IPSec ASO context\n\nThe query or updating IPSec offload object is through Access ASO WQE.\nThe driver uses a single mlx5e_ipsec_aso struct for each PF, which\ncontains a shared DMA-mapped context for all ASO operations.\n\nA race condition exists because the ASO spinlock is released before\nthe hardware has finished processing WQE. If a second operation is\ninitiated immediately after, it overwrites the shared context in the\nDMA area.\n\nWhen the first operation\u0026apos;s completion is processed later, it reads\nthis corrupted context, leading to unexpected behavior and incorrect\nresults.\n\nThis commit fixes the race by introducing a private context within\neach IPSec offload object. The shared ASO context is now copied to\nthis private context while the ASO spinlock is held. Subsequent\nprocessing uses this saved, per-object context, ensuring its integrity\nis maintained.(CVE-2026-23441)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n\nieee80211_tx_prepare_skb() has three error paths, but only two of them\nfree the skb. The first error path (ieee80211_tx_prepare() returning\nTX_DROP) does not free it, while invoke_tx_handlers() failure and the\nfragmentation check both do.\n\nAdd kfree_skb() to the first error path so all three are consistent,\nand remove the now-redundant frees in callers (ath9k, mt76,\nmac80211_hwsim) to avoid double-free.\n\nDocument the skb ownership guarantee in the function\u0026apos;s kdoc.(CVE-2026-23444)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n  if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) \u0026gt; skb_in-\u0026gt;len)\n\nbut the second check omits it:\n\n  if ((sizeof(struct usb_cdc_ncm_ndp16) +\n       ret * (sizeof(struct usb_cdc_ncm_dpe16))) \u0026gt; skb_in-\u0026gt;len)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.(CVE-2026-23448)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops-\u0026gt;syn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock-\u0026gt;sk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n   accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\n   ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u0026gt;\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n  CPU A (softirq)              CPU B (process ctx)\n\n  tcp_v4_rcv()\n    TCP_NEW_SYN_RECV:\n    sk = req-\u0026gt;rsk_listener\n    sock_hold(sk)\n    /* No lock on listener */\n                               smc_close_active():\n                                 write_lock_bh(cb_lock)\n                                 sk_user_data = NULL\n                                 write_unlock_bh(cb_lock)\n                                 ...\n                                 smc_clcsock_release()\n                                 sock_put(smc-\u0026gt;sk) x2\n                                   -\u0026gt; smc_sock freed!\n    tcp_check_req()\n      smc_tcp_syn_recv_sock():\n        smc = user_data(sk)\n          -\u0026gt; NULL or dangling\n        smc-\u0026gt;queued_smc_hs\n          -\u0026gt; crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n  smc_sock freeing is deferred until after the RCU grace\n  period. This guarantees the memory is still valid when\n  accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(\u0026amp;smc-\u0026gt;sk.sk_refcnt) to pin the\n  smc_sock. If the refcount has already reached zero (close\n  path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9(CVE-2026-23450)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM: runtime: Fix a race condition related to device removal\n\nThe following code in pm_runtime_work() may dereference the dev-\u0026gt;parent\npointer after the parent device has been freed:\n\n\t/* Maybe the parent is now able to suspend. */\n\tif (parent \u0026amp;\u0026amp; !parent-\u0026gt;power.ignore_children) {\n\t\tspin_unlock(\u0026amp;dev-\u0026gt;power.lock);\n\n\t\tspin_lock(\u0026amp;parent-\u0026gt;power.lock);\n\t\trpm_idle(parent, RPM_ASYNC);\n\t\tspin_unlock(\u0026amp;parent-\u0026gt;power.lock);\n\n\t\tspin_lock(\u0026amp;dev-\u0026gt;power.lock);\n\t}\n\nFix this by inserting a flush_work() call in pm_runtime_remove().\n\nWithout this patch blktest block/001 triggers the following complaint\nsporadically:\n\nBUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160\nRead of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081\nWorkqueue: pm pm_runtime_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x61/0x80\n print_address_description.constprop.0+0x8b/0x310\n print_report+0xfd/0x1d7\n kasan_report+0xd8/0x1d0\n __kasan_check_byte+0x42/0x60\n lock_acquire.part.0+0x38/0x230\n lock_acquire+0x70/0x160\n _raw_spin_lock+0x36/0x50\n rpm_suspend+0xc6a/0xfe0\n rpm_idle+0x578/0x770\n pm_runtime_work+0xee/0x120\n process_one_work+0xde3/0x1410\n worker_thread+0x5eb/0xfe0\n kthread+0x37b/0x480\n ret_from_fork+0x6cb/0x920\n ret_from_fork_asm+0x11/0x20\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_alloc_info+0x3d/0x50\n __kasan_kmalloc+0xa0/0xb0\n __kmalloc_noprof+0x311/0x990\n scsi_alloc_target+0x122/0xb60 [scsi_mod]\n __scsi_scan_target+0x101/0x460 [scsi_mod]\n scsi_scan_channel+0x179/0x1c0 [scsi_mod]\n scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]\n store_scan+0x2d2/0x390 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810\n do_syscall_64+0xee/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFreed by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_free_info+0x3f/0x50\n __kasan_slab_free+0x67/0x80\n kfree+0x225/0x6c0\n scsi_target_dev_release+0x3d/0x60 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_put+0x7f/0xc0 [scsi_mod]\n sdev_store_delete+0xa5/0x120 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810(CVE-2026-23452)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user\n\nAfter commit ab4eedb790ca (\u0026quot;Bluetooth: L2CAP: Fix corrupted list in\nhci_chan_del\u0026quot;), l2cap_conn_del() uses conn-\u0026gt;lock to protect access to\nconn-\u0026gt;users. However, l2cap_register_user() and l2cap_unregister_user()\ndon\u0026apos;t use conn-\u0026gt;lock, creating a race condition where these functions can\naccess conn-\u0026gt;users and conn-\u0026gt;hchan concurrently with l2cap_conn_del().\n\nThis can lead to use-after-free and list corruption bugs, as reported\nby syzbot.\n\nFix this by changing l2cap_register_user() and l2cap_unregister_user()\nto use conn-\u0026gt;lock instead of hci_dev_lock(), ensuring consistent locking\nfor the l2cap_conn structure.(CVE-2026-23461)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2026-23473)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix statistics allocation\n\nThe controller per-cpu statistics is not allocated until after the\ncontroller has been registered with driver core, which leaves a window\nwhere accessing the sysfs attributes can trigger a NULL-pointer\ndereference.\n\nFix this by moving the statistics allocation to controller allocation\nwhile tying its lifetime to that of the controller (rather than using\nimplicit devres).(CVE-2026-23475)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix krb5 mount with username option\n\nCustomer reported that some of their krb5 mounts were failing against\na single server as the client was trying to mount the shares with\nwrong credentials.  It turned out the client was reusing SMB session\nfrom first mount to try mounting the other shares, even though a\ndifferent username= option had been specified to the other mounts.\n\nBy using username mount option along with sec=krb5 to search for\nprincipals from keytab is supported by cifs.upcall(8) since\ncifs-utils-4.8.  So fix this by matching username mount option in\nmatch_session() even with Kerberos.\n\nFor example, the second mount below should fail with -ENOKEY as there\nis no \u0026apos;foobar\u0026apos; principal in keytab (/etc/krb5.keytab).  The client\nends up reusing SMB session from first mount to perform the second\none, which is wrong.\n\n```\n$ ktutil\nktutil:  add_entry -password -p testuser -k 1 -e aes256-cts\nPassword for (CVE-2026-31392)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix incorrect pte restoration for lazyfree folios\n\nWe batch unmap anonymous lazyfree folios by folio_unmap_pte_batch.  If the\nbatch has a mix of writable and non-writable bits, we may end up setting\nthe entire batch writable.  Fix this by respecting writable bit during\nbatching.\n\nAlthough on a successful unmap of a lazyfree folio, the soft-dirty bit is\nlost, preserve it on pte restoration by respecting the bit during\nbatching, to make the fix consistent w.r.t both writable bit and\nsoft-dirty bit.\n\nI was able to write the below reproducer and crash the kernel. \nExplanation of reproducer (set 64K mTHP to always):\n\nFault in a 64K large folio.  Split the VMA at mid-point with\nMADV_DONTFORK.  fork() - parent points to the folio with 8 writable ptes\nand 8 non-writable ptes.  Merge the VMAs with MADV_DOFORK so that\nfolio_unmap_pte_batch() can determine all the 16 ptes as a batch.  Do\nMADV_FREE on the range to mark the folio as lazyfree.  Write to the memory\nto dirty the pte, eventually rmap will dirty the folio.  Then trigger\nreclaim, we will hit the pte restoration path, and the kernel will crash\nwith the trace given below.\n\nThe BUG happens at:\n\n\tBUG_ON(atomic_inc_return(\u0026amp;ptc-\u0026gt;anon_map_count) \u0026gt; 1 \u0026amp;\u0026amp; rw);\n\nThe code path is asking for anonymous page to be mapped writable into the\npagetable.  The BUG_ON() firing implies that such a writable page has been\nmapped into the pagetables of more than one process, which breaks\nanonymous memory/CoW semantics.\n\n[   21.134473] kernel BUG at mm/page_table_check.c:118!\n[   21.134497] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[   21.135917] Modules linked in:\n[   21.136085] CPU: 1 UID: 0 PID: 1735 Comm: dup-lazyfree Not tainted 7.0.0-rc1-00116-g018018a17770 #1028 PREEMPT\n[   21.136858] Hardware name: linux,dummy-virt (DT)\n[   21.137019] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[   21.137308] pc : page_table_check_set+0x28c/0x2a8\n[   21.137607] lr : page_table_check_set+0x134/0x2a8\n[   21.137885] sp : ffff80008a3b3340\n[   21.138124] x29: ffff80008a3b3340 x28: fffffdffc3d14400 x27: ffffd1a55e03d000\n[   21.138623] x26: 0040000000000040 x25: ffffd1a55f7dd000 x24: 0000000000000001\n[   21.139045] x23: 0000000000000001 x22: 0000000000000001 x21: ffffd1a55f217f30\n[   21.139629] x20: 0000000000134521 x19: 0000000000134519 x18: 005c43e000040000\n[   21.140027] x17: 0001400000000000 x16: 0001700000000000 x15: 000000000000ffff\n[   21.140578] x14: 000000000000000c x13: 005c006000000000 x12: 0000000000000020\n[   21.140828] x11: 0000000000000000 x10: 005c000000000000 x9 : ffffd1a55c079ee0\n[   21.141077] x8 : 0000000000000001 x7 : 005c03e000040000 x6 : 000000004000ffff\n[   21.141490] x5 : ffff00017fffce00 x4 : 0000000000000001 x3 : 0000000000000002\n[   21.141741] x2 : 0000000000134510 x1 : 0000000000000000 x0 : ffff0000c08228c0\n[   21.141991] Call trace:\n[   21.142093]  page_table_check_set+0x28c/0x2a8 (P)\n[   21.142265]  __page_table_check_ptes_set+0x144/0x1e8\n[   21.142441]  __set_ptes_anysz.constprop.0+0x160/0x1a8\n[   21.142766]  contpte_set_ptes+0xe8/0x140\n[   21.142907]  try_to_unmap_one+0x10c4/0x10d0\n[   21.143177]  rmap_walk_anon+0x100/0x250\n[   21.143315]  try_to_unmap+0xa0/0xc8\n[   21.143441]  shrink_folio_list+0x59c/0x18a8\n[   21.143759]  shrink_lruvec+0x664/0xbf0\n[   21.144043]  shrink_node+0x218/0x878\n[   21.144285]  __node_reclaim.constprop.0+0x98/0x338\n[   21.144763]  user_proactive_reclaim+0x2a4/0x340\n[   21.145056]  reclaim_store+0x3c/0x60\n[   21.145216]  dev_attr_store+0x20/0x40\n[   21.145585]  sysfs_kf_write+0x84/0xa8\n[   21.145835]  kernfs_fop_write_iter+0x130/0x1c8\n[   21.145994]  vfs_write+0x2b8/0x368\n[   21.146119]  ksys_write+0x70/0x110\n[   21.146240]  __arm64_sys_write+0x24/0x38\n[   21.146380]  invoke_syscall+0x50/0x120\n[   21.146513]  el0_svc_common.constprop.0+0x48/0xf8\n[   21.146679]  do_el0_svc+0x28/0x40\n[   21.146798]  el0_svc+0x34/0x110\n[   21.146926]  el0t\n---truncated---(CVE-2026-31398)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\u0026quot;libnvdimm: Hold reference on parent while\nscheduling async init\u0026quot;) correctly added a reference on the parent device\nto be held until asynchronous initialization was complete.  However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed.  Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix.  Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add().(CVE-2026-31399)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix cache_request leak in cache_release\n\nWhen a reader\u0026apos;s file descriptor is closed while in the middle of reading\na cache_request (rp-\u0026gt;offset != 0), cache_release() decrements the\nrequest\u0026apos;s readers count but never checks whether it should free the\nrequest.\n\nIn cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the\ncache_request is removed from the queue and freed along with its buffer\nand cache_head reference. cache_release() lacks this cleanup.\n\nThe only other path that frees requests with readers == 0 is\ncache_dequeue(), but it runs only when CACHE_PENDING transitions from\nset to clear. If that transition already happened while readers was\nstill non-zero, cache_dequeue() will have skipped the request, and no\nsubsequent call will clean it up.\n\nAdd the same cleanup logic from cache_read() to cache_release(): after\ndecrementing readers, check if it reached 0 with CACHE_PENDING clear,\nand if so, dequeue and free the cache_request.(CVE-2026-31400)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd\n\nThe /proc/fs/nfs/exports proc entry is created at module init\nand persists for the module\u0026apos;s lifetime. exports_proc_open()\ncaptures the caller\u0026apos;s current network namespace and stores\nits svc_export_cache in seq-\u0026gt;private, but takes no reference\non the namespace. If the namespace is subsequently torn down\n(e.g. container destruction after the opener does setns() to a\ndifferent namespace), nfsd_net_exit() calls nfsd_export_shutdown()\nwhich frees the cache. Subsequent reads on the still-open fd\ndereference the freed cache_detail, walking a freed hash table.\n\nHold a reference on the struct net for the lifetime of the open\nfile descriptor. This prevents nfsd_net_exit() from running --\nand thus prevents nfsd_export_shutdown() from freeing the cache\n-- while any exports fd is open. cache_detail already stores\nits net pointer (cd-\u0026gt;net, set by cache_create_net()), so\nexports_release() can retrieve it without additional per-file\nstorage.(CVE-2026-31403)\n\nIn the Linux kernel, the Bluetooth SCO module\u0026apos;s sco_recv_frame() function contains a use-after-free vulnerability. The function reads conn-\u0026gt;sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() operation can free the socket between the lock release and the subsequent sk-\u0026gt;sk_state access, resulting in a use-after-free vulnerability. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold references under the lock. The vulnerability is fixed by using sco_sock_hold() to acquire a reference before releasing the lock and adding sock_put() on all exit paths.(CVE-2026-31408)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_fw: fix NULL pointer dereference on shared blocks\n\nThe old-method path in fw_classify() calls tcf_block_q() and\ndereferences q-\u0026gt;handle.  Shared blocks leave block-\u0026gt;q NULL, causing a\nNULL deref when an empty cls_fw filter is attached to a shared block\nand a packet with a nonzero major skb mark is classified.\n\nReject the configuration in fw_change() when the old method (no\nTCA_OPTIONS) is used on a shared block, since fw_classify()\u0026apos;s\nold-method path needs block-\u0026gt;q which is NULL for shared blocks.\n\nThe fixed null-ptr-deref calling stack:\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:fw_classify (net/sched/cls_fw.c:81)\n Call Trace:\n  tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)\n  tc_run (net/core/dev.c:4401)\n  __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)(CVE-2026-31421)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: fix NULL pointer dereference on shared blocks\n\nflow_change() calls tcf_block_q() and dereferences q-\u0026gt;handle to derive\na default baseclass.  Shared blocks leave block-\u0026gt;q NULL, causing a NULL\nderef when a flow filter without a fully qualified baseclass is created\non a shared block.\n\nCheck tcf_block_shared() before accessing block-\u0026gt;q and return -EINVAL\nfor shared blocks.  This avoids the null-deref shown below:\n\n=======================================================================\nKASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\nRIP: 0010:flow_change (net/sched/cls_flow.c:508)\nCall Trace:\n tc_new_tfilter (net/sched/cls_api.c:2432)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)\n [...]\n=======================================================================(CVE-2026-31422)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: EC: clean up handlers on probe failure in acpi_ec_setup()\n\nWhen ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware\nplatforms, it has already started the EC and installed the address\nspace handler with the struct acpi_ec pointer as handler context.\nHowever, acpi_ec_setup() propagates the error without any cleanup.\n\nThe caller acpi_ec_add() then frees the struct acpi_ec for non-boot\ninstances, leaving a dangling handler context in ACPICA.\n\nAny subsequent AML evaluation that accesses an EC OpRegion field\ndispatches into acpi_ec_space_handler() with the freed pointer,\ncausing a use-after-free:\n\n BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)\n Write of size 8 at addr ffff88800721de38 by task init/1\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  mutex_lock (kernel/locking/mutex.c:289)\n  acpi_ec_space_handler (drivers/acpi/ec.c:1362)\n  acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)\n  acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)\n  acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)\n  acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)\n  acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)\n  acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 1:\n  acpi_ec_alloc (drivers/acpi/ec.c:1424)\n  acpi_ec_add (drivers/acpi/ec.c:1692)\n\n Freed by task 1:\n  kfree (mm/slub.c:6876)\n  acpi_ec_add (drivers/acpi/ec.c:1751)\n\nThe bug triggers on reduced-hardware EC platforms (ec-\u0026gt;gpe \u0026lt; 0)\nwhen the GPIO IRQ provider defers probing. Once the stale handler\nexists, any unprivileged sysfs read that causes AML to touch an\nEC OpRegion (battery, thermal, backlight) exercises the dangling\npointer.\n\nFix this by calling ec_remove_handlers() in the error path of\nacpi_ec_setup() before clearing first_ec. ec_remove_handlers()\nchecks each EC_FLAGS_* bit before acting, so it is safe to call\nregardless of how far ec_install_handlers() progressed:\n\n  -ENODEV  (handler not installed): only calls acpi_ec_stop()\n  -EPROBE_DEFER (handler installed): removes handler, stops EC(CVE-2026-31426)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb: fix cross-cache free of KFENCE-allocated skb head\n\nSKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2\nvalue (e.g. 704 on x86_64) to avoid collisions with generic kmalloc\nbucket sizes. This ensures that skb_kfree_head() can reliably use\nskb_end_offset to distinguish skb heads allocated from\nskb_small_head_cache vs. generic kmalloc caches.\n\nHowever, when KFENCE is enabled, kfence_ksize() returns the exact\nrequested allocation size instead of the slab bucket size. If a caller\n(e.g. bpf_test_init) allocates skb head data via kzalloc() and the\nrequested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then\nslab_build_skb() -\u0026gt; ksize() returns that exact value. After subtracting\nskb_shared_info overhead, skb_end_offset ends up matching\nSKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free\nthe object to skb_small_head_cache instead of back to the original\nkmalloc cache, resulting in a slab cross-cache free:\n\n  kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected\n  skbuff_small_head but got kmalloc-1k\n\nFix this by always calling kfree(head) in skb_kfree_head(). This keeps\nthe free path generic and avoids allocator-specific misclassification\nfor KFENCE objects.(CVE-2026-31429)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nX.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length.  Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list.(CVE-2026-31430)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released.(CVE-2026-31441)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it\u0026apos;s possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes.(CVE-2026-31442)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\u0026quot;ext4: fix bug_on in start_this_handle during umount\nfilesystem\u0026quot;) moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -\u0026gt; sysfs_notify() which\naccesses the kobject\u0026apos;s kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n  update_super_work                ext4_put_super\n  -----------------                --------------\n                                   ext4_unregister_sysfs(sb)\n                                     kobject_del(\u0026amp;sbi-\u0026gt;s_kobj)\n                                       __kobject_del()\n                                         sysfs_remove_dir()\n                                           kobj-\u0026gt;sd = NULL\n                                         sysfs_put(sd)\n                                           kernfs_put()  // RCU free\n  ext4_notify_error_sysfs(sbi)\n    sysfs_notify(\u0026amp;sbi-\u0026gt;s_kobj)\n      kn = kobj-\u0026gt;sd              // stale pointer\n      kernfs_get(kn)             // UAF on freed kernfs_node\n                                   ext4_journal_destroy()\n                                     flush_work(\u0026amp;sbi-\u0026gt;s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call.(CVE-2026-31446)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx-\u0026gt;ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.(CVE-2026-31449)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u0026gt;jinode to concurrent users.\nIt used to set ei-\u0026gt;jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u0026gt;i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u0026lt;49\u0026gt; 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u0026lt;TASK\u0026gt;\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u0026gt;jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer.(CVE-2026-31450)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption.(CVE-2026-31451)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u0026gt; inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0026apos;s actual\ninline capacity (EXT4_I(inode)-\u0026gt;i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.(CVE-2026-31452)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n  submit_bio                      //bio_list is initialized.\n    mmc_blk_mq_recovery\n      z_erofs_endio\n        vm_map_ram\n          __pte_alloc_kernel\n            __alloc_pages_direct_reclaim\n              shrink_folio_list\n                __swap_writepage\n                  submit_bio_wait  //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path.(CVE-2026-31467)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device\u0026apos;s IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb-\u0026gt;dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n  ...\n  percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n  dst_release+0xe0/0x110  net/core/dst.c:177\n  skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n  sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n  dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n  napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n  __free_old_xmit+0x164/0x230  drivers/net/virtio_net.c:611 [virtio_net]\n  free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n  start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n  ...\n\nReproduction Steps:\nNETDEV=\u0026quot;enp3s0\u0026quot;\n\nconfig_qdisc_route_filter() {\n    tc qdisc del dev $NETDEV root\n    tc qdisc add dev $NETDEV root handle 1: prio\n    tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n    ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n    ip netns add testns\n    ip link set $NETDEV netns testns\n    ip netns exec testns ifconfig $NETDEV  10.0.32.46/24\n    ip netns exec testns ping -c 1 10.0.32.1\n    ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns(CVE-2026-31469)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus\u0026apos; match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \u0026quot;\u0026quot; to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\u0026quot;\\n\u0026quot; instead of \u0026quot;(null)\\n\u0026quot;.(CVE-2026-31487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values \u0026gt; TCP_CONNTRACK_SYN_SENT2 at\n  policy level, removing the manual \u0026gt;= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values \u0026gt; TCP_MAX_WSCALE\n  (14). The normal TCP option parsing path already clamps to this value,\n  but the ctnetlink path accepted 0-255, causing undefined behavior when\n  used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n  CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n  a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree.(CVE-2026-31495)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\u0026quot;netfilter: conntrack: do not dump other netns\u0026apos;s\nconntrack entries via proc\u0026quot;).(CVE-2026-31496)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan-\u0026gt;sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard.(CVE-2026-31498)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn-\u0026gt;lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn-\u0026gt;lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn-\u0026gt;lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del().(CVE-2026-31499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\u0026quot;ethtool -L\u0026quot; and \u0026quot;ethtool -S\u0026quot; simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u0026gt; num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -\u0026gt; buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -\u0026gt; out-of-bounds!\n                            iavf_finish_config()\n                            -\u0026gt; real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  \u0026lt;/TASK\u0026gt;\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u0026gt;ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8(CVE-2026-31505)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __kasan_check_byte+0x12/0x40\n  lock_acquire+0x79/0x2e0\n  lock_sock_nested+0x48/0x100\n  ? l2cap_sock_ready_cb+0x46/0x160\n  l2cap_sock_ready_cb+0x46/0x160\n  l2cap_conn_start+0x779/0xff0\n  ? __pfx_l2cap_conn_start+0x10/0x10\n  ? l2cap_info_timeout+0x60/0xa0\n  ? __pfx___mutex_lock+0x10/0x10\n  l2cap_info_timeout+0x68/0xa0\n  ? process_scheduled_works+0xa8d/0x18c0\n  process_scheduled_works+0xb6e/0x18c0\n  ? __pfx_process_scheduled_works+0x10/0x10\n  ? assign_work+0x3d5/0x5e0\n  worker_thread+0xa53/0xfc0\n  kthread+0x388/0x470\n  ? __pfx_worker_thread+0x10/0x10\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x51e/0xb90\n  ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n  ? __switch_to+0xc7d/0x1450\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm \u0026apos;minstrel_ht\u0026apos;\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception(CVE-2026-31510)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory.(CVE-2026-31511)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() reads the SDU length field from skb-\u0026gt;data using\nget_unaligned_le16() without first verifying that skb contains at least\nL2CAP_SDULEN_SIZE (2) bytes. When skb-\u0026gt;len is less than 2, this reads\npast the valid data in the skb.\n\nThe ERTM reassembly path correctly calls pskb_may_pull() before reading\nthe SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the\nsame validation to the Enhanced Credit Based Flow Control data path.(CVE-2026-31512)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net.(CVE-2026-31516)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error.(CVE-2026-31518)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter\u0026apos;s signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier\u0026apos;s abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter\u0026apos;s sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs().(CVE-2026-31525)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx-\u0026gt;pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx-\u0026gt;pmu.\n\nTurns out, inherit uses event-\u0026gt;pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx-\u0026gt;pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx-\u0026gt;pmu for the\ngroup case.(CVE-2026-31528)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u0026lt;/TASK\u0026gt;\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048(CVE-2026-31531)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u0026gt;uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u0026gt;uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u0026gt;uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually](CVE-2026-31532)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\u0026quot;net: tls: handle backlogging of crypto requests\u0026quot;), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge-\u0026gt;offset, sge-\u0026gt;length) and decrements\nctx-\u0026gt;encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration.(CVE-2026-31533)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[   23.289926] PM: suspend entry (deep)\n[   23.293558] Filesystems sync: 0.000 seconds\n[   23.298010] Freezing user space processes\n[   23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[   23.309766] OOM killer disabled.\n[   23.313027] Freezing remaining freezable tasks\n[   23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[   23.342038] serial 00:05: disabled\n[   23.345719] serial 00:02: disabled\n[   23.349342] serial 00:01: disabled\n[   23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[   23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[   23.361635] ata1.00: Entering standby power mode\n[   23.368863] ata2.00: Entering standby power mode\n[   23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[   23.452194] #PF: supervisor instruction fetch in kernel mode\n[   23.457896] #PF: error_code(0x0010) - not-present page\n[   23.463065] PGD 0 P4D 0\n[   23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[   23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S      W           6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[   23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[   23.496511] Workqueue: async async_run_entry_fn\n[   23.501087] RIP: 0010:0x0\n[   23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[   23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[   23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[   23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[   23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[   23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[   23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[   23.551457] FS:  0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[   23.559588] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[   23.572539] PKRU: 55555554\n[   23.575281] Call Trace:\n[   23.577770]  \u0026lt;TASK\u0026gt;\n[   23.579905]  intel_engines_reset_default_submission+0x42/0x60\n[   23.585695]  __intel_gt_unset_wedged+0x191/0x200\n[   23.590360]  intel_gt_unset_wedged+0x20/0x40\n[   23.594675]  gt_sanitize+0x15e/0x170\n[   23.598290]  i915_gem_suspend_late+0x6b/0x180\n[   23.602692]  i915_drm_suspend_late+0x35/0xf0\n[   23.607008]  ? __pfx_pci_pm_suspend_late+0x10/0x10\n[   23.611843]  dpm_run_callback+0x78/0x1c0\n[   23.615817]  device_suspend_late+0xde/0x2e0\n[   23.620037]  async_suspend_late+0x18/0x30\n[   23.624082]  async_run_entry_fn+0x25/0xa0\n[   23.628129]  process_one_work+0x15b/0x380\n[   23.632182]  worker_thread+0x2a5/0x3c0\n[   23.635973]  ? __pfx_worker_thread+0x10/0x10\n[   23.640279]  kthread+0xf6/0x1f0\n[   23.643464]  ? __pfx_kthread+0x10/0x10\n[   23.647263]  ? __pfx_kthread+0x10/0x10\n[   23.651045]  ret_from_fork+0x131/0x190\n[   23.654837]  ? __pfx_kthread+0x10/0x10\n[   23.658634]  ret_from_fork_asm+0x1a/0x30\n[   23.662597]  \u0026lt;/TASK\u0026gt;\n[   23.664826] Modules linked in:\n[   23.667914] CR2: 0000000000000000\n[   23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)(CVE-2026-31540)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it\u0026apos;s mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes.(CVE-2026-31542)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info-\u0026gt;slave without checking if it\u0026apos;s NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info-\u0026gt;slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[    1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[    1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[    1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[    1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[    1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[    1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[    1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[    1.294864] FS:  0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[    1.295239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[    1.295897] Call Trace:\n[    1.296134]  seq_read_iter (fs/seq_file.c:231)\n[    1.296341]  seq_read (fs/seq_file.c:164)\n[    1.296493]  full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[    1.296658]  vfs_read (fs/read_write.c:572)\n[    1.296981]  ksys_read (fs/read_write.c:717)\n[    1.297132]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[    1.297325]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \u0026quot;(none)\u0026quot; for entries with no assigned slave.(CVE-2026-31546)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in \u0026apos;exiting\u0026apos;.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.(CVE-2026-31555)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory \u0026apos;f\u0026apos; (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)(CVE-2026-31566)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8-\u0026gt;from_idx, cf-\u0026gt;len);\n    int to   = calc_idx(crc8-\u0026gt;to_idx,   cf-\u0026gt;len);\n    int res  = calc_idx(crc8-\u0026gt;result_idx, cf-\u0026gt;len);\n\n    if (from \u0026lt; 0 || to \u0026lt; 0 || res \u0026lt; 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8-\u0026gt;from_idx; ...)        /* BUG: raw negative index */\n    cf-\u0026gt;data[crc8-\u0026gt;result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf-\u0026gt;data[-64], and the write goes to cf-\u0026gt;data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (\u0026lt;= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.(CVE-2026-31570)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, \u0026amp;range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \u0026quot;addr\u0026quot;\nand \u0026quot;size\u0026quot; are u64s and SEV is 64-bit only, i.e. they _can\u0026apos;t_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range-\u0026gt;addr \u0026gt; ULONG_MAX || range-\u0026gt;size \u0026gt; ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \u0026quot;hard\u0026quot; way, e.g. instead of just shifting @ulen.(CVE-2026-31590)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup\n\nDisable the delayed work before clearing BAR mappings and doorbells to\navoid running the handler after resources have been torn down.\n\n  Unable to handle kernel paging request at virtual address ffff800083f46004\n  [...]\n  Internal error: Oops: 0000000096000007 [#1]  SMP\n  [...]\n  Call trace:\n   epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n   process_one_work+0x154/0x3b0\n   worker_thread+0x2c8/0x400\n   kthread+0x148/0x210\n   ret_from_fork+0x10/0x20(CVE-2026-31595)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1\u0026apos;s hardware divider can leave, under certain circumstances, partial\nresults from previous operations.  Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit.(CVE-2026-31628)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \u0026quot;%pISpc\u0026quot;.\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n  [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter\u0026apos;s maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n  explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n  mapped-v4 example(CVE-2026-31630)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free.(CVE-2026-31651)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n  nf_conntrack_tcp_packet+0x1381/0x29d0\n  nf_conntrack_in+0x612/0x8b0\n  nf_hook_slow+0x70/0x100\n  __ip_local_out+0x1b2/0x210\n  tcp_sendmsg_locked+0x722/0x1580\n  __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n  nft_ct_timeout_obj_init+0xf6/0x290\n  nft_obj_init+0x107/0x1b0\n  nf_tables_newobj+0x680/0x9c0\n  nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n  nft_obj_destroy+0x3f/0xa0\n  nf_tables_trans_destroy_work+0x51c/0x5c0\n  process_one_work+0x2c4/0x5a0(CVE-2026-31665)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n  ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff-\u0026gt;mutex and calls\n   uinput_dev_upload_effect() -\u0026gt; uinput_request_submit() -\u0026gt;\n   uinput_request_send(), which acquires udev-\u0026gt;mutex.\n\n2. device create: uinput_ioctl_handler() holds udev-\u0026gt;mutex and calls\n   uinput_create_device() -\u0026gt; input_register_device(), which acquires\n   input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n   calls kbd_connect() -\u0026gt; input_register_handle(), which acquires\n   dev-\u0026gt;mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n   dev-\u0026gt;mutex, which calls input_ff_flush() acquiring ff-\u0026gt;mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev-\u0026gt;state and udev-\u0026gt;dev access in uinput_request_send() instead of\nacquiring udev-\u0026gt;mutex.  The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\nbreaks the ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev-\u0026gt;state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(\u0026amp;request-\u0026gt;done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot().  Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n  ff-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex (no back-edge)(CVE-2026-31667)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb-\u0026gt;data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb-\u0026gt;data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic.(CVE-2026-31675)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - limit RX SG extraction by receive buffer budget\n\nMake af_alg_get_rsgl() limit each RX scatterlist extraction to the\nremaining receive buffer budget.\n\naf_alg_get_rsgl() currently uses af_alg_readable() only as a gate\nbefore extracting data into the RX scatterlist. Limit each extraction\nto the remaining af_alg_rcvbuf(sk) budget so that receive-side\naccounting matches the amount of data attached to the request.\n\nIf skcipher cannot obtain enough RX space for at least one chunk while\nmore data remains to be processed, reject the recvmsg call instead of\nrounding the request length down to zero.(CVE-2026-31677)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u0026gt;dev.\n\nDo not release vport-\u0026gt;dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.(CVE-2026-31678)\n\nIn the Linux kernel, a memory out-of-bounds access vulnerability exists in the act_csum module\u0026apos;s tcf_csum_act() function when processing nested VLAN headers. When an skb still carries in-payload VLAN tags, the function walks nested VLAN headers directly from skb-\u0026gt;data. The current code reads vlan-\u0026gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.(CVE-2026-31684)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par-\u0026gt;fragoff != 0`. For packets with `par-\u0026gt;fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par-\u0026gt;fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`.(CVE-2026-31685)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/mc: Fix error path ordering in edac_mc_alloc()\n\nWhen the mci-\u0026gt;pvt_info allocation in edac_mc_alloc() fails, the error path\nwill call put_device() which will end up calling the device\u0026apos;s release\nfunction.\n\nHowever, the init ordering is wrong such that device_initialize() happens\n*after* the failed allocation and thus the device itself and the release\nfunction pointer are not initialized yet when they\u0026apos;re called:\n\n  MCE: In-kernel MCE decoding enabled.\n  ------------[ cut here ]------------\n  kobject: \u0026apos;(null)\u0026apos;: is not initialized, yet kobject_put() is being called.\n  WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n  CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n  RIP: 0010:kobject_put\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   edac_mc_alloc+0xbe/0xe0 [edac_core]\n   amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n   ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n   do_one_initcall\n   ...\n\nReorder the calling sequence so that the device is initialized and thus the\nrelease function pointer is properly set before it can be used.\n\nThis was found by Claude while reviewing another EDAC patch.(CVE-2026-31689)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don\u0026apos;t attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don\u0026apos;t attempt to copy the blobs to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31698)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don\u0026apos;t attempt to copy the blob to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31699)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp-\u0026gt;Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds.(CVE-2026-31708)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31738)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31752)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep-\u0026gt;desc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep-\u0026gt;desc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready.(CVE-2026-31755)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026amp;hdev-\u0026gt;lock) and add\nlockdep_assert_held(\u0026amp;hdev-\u0026gt;lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt().(CVE-2026-31771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated.(CVE-2026-31773)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif-\u0026gt;matches is at least\nas large as the number of bytes to copy. Otherwise, results-\u0026gt;matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2026-31779)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list.(CVE-2026-31781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.(CVE-2026-43020)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: use skb_header_pointer() for TCPv4 GSO frag_off check\n\nSyzbot reported a KMSAN uninit-value warning in gso_features_check()\ncalled from netif_skb_features() [1].\n\ngso_features_check() reads iph-\u0026gt;frag_off to decide whether to clear\nmangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()\ncan rely on skb header offsets that are not always safe for direct\ndereference on packets injected from PF_PACKET paths.\n\nUse skb_header_pointer() for the TCPv4 frag_off check so the header read\nis robust whether data is already linear or needs copying.\n\n[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407(CVE-2026-43036)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.(CVE-2026-43040)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL\u0026apos;s last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl().(CVE-2026-43043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Fix TX deadlock when using DMA\n\n`dmaengine_terminate_async` does not guarantee that the\n`__dma_tx_complete` callback will run. The callback is currently the\nonly place where `dma-\u0026gt;tx_running` gets cleared. If the transaction is\ncanceled and the callback never runs, then `dma-\u0026gt;tx_running` will never\nget cleared and we will never schedule new TX DMA transactions again.\n\nThis change makes it so we clear `dma-\u0026gt;tx_running` after we terminate\nthe DMA transaction. This is \u0026quot;safe\u0026quot; because `serial8250_tx_dma_flush`\nis holding the UART port lock. The first thing the callback does is also\ngrab the UART port lock, so access to `dma-\u0026gt;tx_running` is serialized.(CVE-2026-43061)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed.(CVE-2026-43064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Skip discovery table for offline dies\n\nThis warning can be triggered if NUMA is disabled and the system\nboots with fewer CPUs than the number of CPUs in die 0.\n\nWARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nCurrently, the discovery table continues to be parsed even if all CPUs\nin the associated die are offline.  This can lead to an array overflow\nat \u0026quot;pmu-\u0026gt;boxes[die] = box\u0026quot; in uncore_pci_pmu_register(), which may\ntrigger the warning above or cause other issues.(CVE-2026-43079)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub-\u0026gt;ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \u0026quot;No Such Interface\u0026quot;.(CVE-2026-43099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/smp: Add check for kcalloc() failure in parse_thread_groups()\n\nAs kcalloc() may fail, check its return value to avoid a NULL pointer\ndereference when passing it to of_property_read_u32_array().(CVE-2026-43148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\u0026quot;net: usb: rtl8150: enable basic endpoint checking\u0026quot;)\n- commit 9e7021d2aeae (\u0026quot;net: usb: catc: enable basic endpoint checking\u0026quot;)(CVE-2026-43156)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]\n\nThis is a use-after-free race between bitmap_daemon_work() and\n__bitmap_resize(). The daemon iterates over `bitmap-\u0026gt;storage.filemap`\nwithout locking, while the resize path frees that storage via\nmd_bitmap_file_unmap(). `quiesce()` does not stop the md thread,\nallowing concurrent access to freed pages.\n\nFix by holding `mddev-\u0026gt;bitmap_info.mutex` during the bitmap update.(CVE-2026-43163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u0026gt;nodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u0026gt;type (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00).(CVE-2026-43186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE\n\nThe arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE -\nwhich is a valid index - so add a check for this.(CVE-2026-43212)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: add a sanity check on previous kernel\u0026apos;s ima kexec buffer\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \u0026quot;mem=\u0026lt;size\u0026gt;\u0026quot;, the physical range that contains the carried\nover IMA measurement list may fall outside the truncated RAM leading to a\nkernel panic.\n\n    BUG: unable to handle page fault for address: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x0000) – not-present page\n\nOther architectures already validate the range with page_is_ram(), as done\nin commit cbf9c4b9617b (\u0026quot;of: check previous kernel\u0026apos;s ima-kexec-buffer\nagainst memory bounds\u0026quot;) do a similar check on x86.\n\nWithout carrying the measurement list across kexec, the attestation\nwould fail.(CVE-2026-43240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fiemap page fault fix\n\nIn gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode\nglock.  This can lead to recursive glock taking if the fiemap buffer is\nmemory mapped to the same inode and accessing it triggers a page fault.\n\nFix by disabling page faults for iomap_fiemap() and faulting in the\nbuffer by hand if necessary.\n\nFixes xfstest generic/742.(CVE-2026-43262)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: supply snapshot context in ceph_zero_partial_object()\n\nThe ceph_zero_partial_object function was missing proper snapshot\ncontext for its OSD write operations, which could lead to data\ninconsistencies in snapshots.\n\nReproducer:\n../src/vstart.sh --new -x --localhost --bluestore\n./bin/ceph auth caps client.fs_a mds \u0026apos;allow rwps fsname=a\u0026apos; mon \u0026apos;allow r fsname=a\u0026apos; osd \u0026apos;allow rw tag cephfs data=a\u0026apos;\nmount -t ceph (CVE-2026-43273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: move ext4_percpu_param_init() before ext4_mb_init()\n\nWhen running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the\n`DOUBLE_CHECK` macro defined, the following panic is triggered:\n\n==================================================================\nEXT4-fs error (device vdc): ext4_validate_block_bitmap:423:\n                        comm mount: bg 0: bad block bitmap checksum\nBUG: unable to handle page fault for address: ff110000fa2cc000\nPGD 3e01067 P4D 3e02067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W\n                        6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)\nRIP: 0010:percpu_counter_add_batch+0x13/0xa0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_mark_group_bitmap_corrupted+0xcb/0xe0\n ext4_validate_block_bitmap+0x2a1/0x2f0\n ext4_read_block_bitmap+0x33/0x50\n mb_group_bb_bitmap_alloc+0x33/0x80\n ext4_mb_add_groupinfo+0x190/0x250\n ext4_mb_init_backend+0x87/0x290\n ext4_mb_init+0x456/0x640\n __ext4_fill_super+0x1072/0x1680\n ext4_fill_super+0xd3/0x280\n get_tree_bdev_flags+0x132/0x1d0\n vfs_get_tree+0x29/0xd0\n vfs_cmd_create+0x59/0xe0\n __do_sys_fsconfig+0x4f6/0x6b0\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nThis issue can be reproduced using the following commands:\n        mkfs.ext4 -F -q -b 1024 /dev/sda 5G\n        tune2fs -O quota,project /dev/sda\n        mount /dev/sda /tmp/test\n\nWith DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads\nand validates the block bitmap. When the validation fails,\next4_mark_group_bitmap_corrupted() attempts to update\nsbi-\u0026gt;s_freeclusters_counter. However, this percpu_counter has not been\ninitialized yet at this point, which leads to the panic described above.\n\nFix this by moving the execution of ext4_percpu_param_init() to occur\nbefore ext4_mb_init(), ensuring the per-CPU counters are initialized\nbefore they are used.(CVE-2026-43288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks.  Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -\u0026gt; kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n  rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n  rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n  ...\n  task:kworker/0:17 state:R running task stack:28840 pid:6229\n  ...\n  kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n  purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock.  Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load.(CVE-2026-43292)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.(CVE-2026-43345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0026apos;s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0026apos;ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0026apos;s of the correct type. Add those\nchecks.(CVE-2026-43366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segment ends up being less than the size of the\nmessage header or a different frame is made to look like a message\nframe, out-of-bounds reads may ensue in process_message_header().\n\nPerform an explicit bounds check before decoding the message header.(CVE-2026-43406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix memory leaks in ceph_mdsc_build_path()\n\nAdd __putname() calls to error code paths that did not free the \u0026quot;path\u0026quot;\npointer obtained by __getname().  If ownership of this pointer is not\npassed to the caller via path_info.path, the function must free it\nbefore returning.(CVE-2026-43419)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u0026gt;length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.(CVE-2026-43427)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations.  And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts.  The limit chosen here, somewhat\narbitrarily, is 60 seconds.  On many systems (although not all) this\nis short enough to avoid triggering the kernel\u0026apos;s hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout.(CVE-2026-43428)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix deadlock between devlink lock and esw-\u0026gt;wq\n\nesw-\u0026gt;work_queue executes esw_functions_changed_event_handler -\u0026gt;\nesw_vfs_changed_event_handler and acquires the devlink lock.\n\n.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -\u0026gt;\nmlx5_devlink_eswitch_mode_set -\u0026gt; mlx5_eswitch_disable_locked -\u0026gt;\nmlx5_eswitch_event_handler_unregister -\u0026gt; flush_workqueue deadlocks\nwhen esw_vfs_changed_event_handler executes.\n\nFix that by no longer flushing the work to avoid the deadlock, and using\na generation counter to keep track of work relevance. This avoids an old\nhandler manipulating an esw that has undergone one or more mode changes:\n- the counter is incremented in mlx5_eswitch_event_handler_unregister.\n- the counter is read and passed to the ephemeral mlx5_host_work struct.\n- the work handler takes the devlink lock and bails out if the current\n  generation is different than the one it was scheduled to operate on.\n- mlx5_eswitch_cleanup does the final draining before destroying the wq.\n\nNo longer flushing the workqueue has the side effect of maybe no longer\ncancelling pending vport_change_handler work items, but that\u0026apos;s ok since\nthose are disabled elsewhere:\n- mlx5_eswitch_disable_locked disables the vport eq notifier.\n- mlx5_esw_vport_disable disarms the HW EQ notification and marks\n  vport-\u0026gt;enabled under state_lock to false to prevent pending vport\n  handler from doing anything.\n- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events\n  are disabled/finished.(CVE-2026-43468)\n\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: pcrypt - Fix handling of MAY_BACKLOG requests  MAY_BACKLOG requests can return EBUSY.  Handle them by checking for that value and filtering out EINPROGRESS notifications.  The Linux kernel CVE team has assigned CVE-2026-43493 to this issue.(CVE-2026-43493)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u0026gt;flags when\nmoving frags from source to destination.  __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u0026gt;flags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched.  As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data().  ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0026apos;dup to \u0026lt;local\u0026gt;\u0026apos; rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0026apos;d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source.  skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0026apos;s frag descriptors into the\naccumulator\u0026apos;s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0026apos;s frag_list.  Downstream skb_segment() reads only\nskb_shinfo(p)-\u0026gt;flags, and skb_segment_list() reuses each sub-skb\u0026apos;s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb.  The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0026apos;s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0026apos;s flag into nskb.  Fold frag_skb\u0026apos;s flag at both sites\nso segments drawing frags from frag_list members carry the marker.(CVE-2026-43503)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().(CVE-2026-45834)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\u0026quot;gfs2: Free quota data objects synchronously\u0026quot;)\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption.  This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey \u0026lt;(CVE-2026-45861)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix role switching during resume\n\nIf the role change while we are suspended, the cdns3 driver switches to the\nnew mode during resume. However, switching to host mode in this context\ncauses a NULL pointer dereference.\n\nThe host role\u0026apos;s start() operation registers a xhci-hcd device, but its\nprobe is deferred while we are in the resume path. The host role\u0026apos;s resume()\noperation assumes the xhci-hcd device is already probed, which is not the\ncase, leading to the dereference. Since the start() operation of the new\nrole is already called, the resume operation can be skipped.\n\nSo skip the resume operation for the new role if a role switch occurs\nduring resume. Once the resume sequence is complete, the xhci-hcd device\ncan be probed in case of host mode.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000208\nMem abort info:\n...\nData abort info:\n...\n[0000000000000208] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1]  SMP\nModules linked in:\nCPU: 0 UID: 0 PID: 146 Comm: sh Not tainted\n6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT\nHardware name: Texas Instruments J7200 EVM (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : usb_hcd_is_primary_hcd+0x0/0x1c\nlr : cdns_host_resume+0x24/0x5c\n...\nCall trace:\n usb_hcd_is_primary_hcd+0x0/0x1c (P)\n cdns_resume+0x6c/0xbc\n cdns3_controller_resume.isra.0+0xe8/0x17c\n cdns3_plat_resume+0x18/0x24\n platform_pm_resume+0x2c/0x68\n dpm_run_callback+0x90/0x248\n device_resume+0x100/0x24c\n dpm_resume+0x190/0x2ec\n dpm_resume_end+0x18/0x34\n suspend_devices_and_enter+0x2b0/0xa44\n pm_suspend+0x16c/0x5fc\n state_store+0x80/0xec\n kobj_attr_store+0x18/0x2c\n sysfs_kf_write+0x7c/0x94\n kernfs_fop_write_iter+0x130/0x1dc\n vfs_write+0x240/0x370\n ksys_write+0x70/0x108\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0x108\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)\n---[ end trace 0000000000000000 ]---(CVE-2026-45911)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inline data read failure for ztailpacking pclusters\n\nCompressed folios for ztailpacking pclusters must be valid before adding\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\nmay assume they are already valid and then trigger a NULL pointer\ndereference.\n\nIt is somewhat hard to reproduce because the inline data is in the same\nblock as the tail of the compressed indexes, which are usually read just\nbefore. However, it may still happen if a fatal signal arrives while\nread_mapping_folio() is running, as shown below:\n\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n\n ...\n\n pc : z_erofs_decompress_queue+0x4c8/0xa14\n lr : z_erofs_decompress_queue+0x160/0xa14\n sp : ffffffc08b3eb3a0\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\n Call trace:\n  z_erofs_decompress_queue+0x4c8/0xa14\n  z_erofs_runqueue+0x908/0x97c\n  z_erofs_read_folio+0x128/0x228\n  filemap_read_folio+0x68/0x128\n  filemap_get_pages+0x44c/0x8b4\n  filemap_read+0x12c/0x5b8\n  generic_file_read_iter+0x4c/0x15c\n  do_iter_readv_writev+0x188/0x1e0\n  vfs_iter_read+0xac/0x1a4\n  backing_file_read_iter+0x170/0x34c\n  ovl_read_iter+0xf0/0x140\n  vfs_read+0x28c/0x344\n  ksys_read+0x80/0xf0\n  __arm64_sys_read+0x24/0x34\n  invoke_syscall+0x60/0x114\n  el0_svc_common+0x88/0xe4\n  do_el0_svc+0x24/0x30\n  el0_svc+0x40/0xa8\n  el0t_64_sync_handler+0x70/0xbc\n  el0t_64_sync+0x1bc/0x1c0\n\nFix this by reading the inline data before allocating and adding\nthe pclusters to the I/O chains.(CVE-2026-45943)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()\n\nIn amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM,\nthe function returns directly without releasing the allocated xcc_info,\nresulting in a memory leak.\n\nFix this by ensuring that xcc_info is properly freed in the error paths.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.(CVE-2026-45947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0026apos;t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n  unreferenced object 0xffff88801d7bca80 (size 4480):\n    copy_process+0x3a1/0x4670 kernel/fork.c:2422\n    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n  unreferenced object 0xffff88812de7c000 (size 8192):\n    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275(CVE-2026-45961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()\n\nCover a missed execution path with a new check.(CVE-2026-45982)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()\n\nSome crafted images can have illegal (!partial_decoding \u0026amp;\u0026amp;\nm_llen \u0026lt; m_plen) extents, and the LZ4 inplace decompression path\ncan be wrongly hit, but it cannot handle (outpages \u0026lt; inpages)\nproperly: \u0026quot;outpages - inpages\u0026quot; wraps to a large value and\nthe subsequent rq-\u0026gt;out[] access reads past the decompressed_pages\narray.\n\nHowever, such crafted cases can correctly result in a corruption\nreport in the normal LZ4 non-inplace path.\n\nLet\u0026apos;s add an additional check to fix this for backporting.\n\nReproducible image (base64-encoded gzipped blob):\n\nH4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g\ndilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i\nPNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz\n2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w\nywAAAAAAAADwu14ATsEYtgBQAAA=\n\n$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt\n$ dd if=/mnt/data of=/dev/null bs=4096 count=1(CVE-2026-45999)\n\nIn the Linux kernel, the following vulnerability has been resolved:  ipmi:ssif: Clean up kthread on errors  If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped.  So make sure the kthread is stopped on an error condition if it is running.  The Linux kernel CVE team has assigned CVE-2026-46044 to this issue.(CVE-2026-46044)\n\nIn the Linux kernel, the following vulnerability has been resolved:  md/raid5: fix soft lockup in retry_aligned_read()  When retry_aligned_read() encounters an overlapped stripe, it releases the stripe via raid5_release_stripe() which puts it on the lockless released_stripes llist. In the next raid5d loop iteration, release_stripe_list() drains the stripe onto handle_list (since STRIPE_HANDLE is set by the original IO), but retry_aligned_read() runs before handle_active_stripes() and removes the stripe from handle_list via find_get_stripe() -\u0026gt; list_del_init(). This prevents handle_stripe() from ever processing the stripe to resolve the overlap, causing an infinite loop and soft lockup.  Fix this by using __release_stripe() with temp_inactive_list instead of raid5_release_stripe() in the failure path, so the stripe does not go through the released_stripes llist. This allows raid5d to break out of its loop, and the overlap will be resolved when the stripe is eventually processed by handle_stripe().  The Linux kernel CVE team has assigned CVE-2026-46051 to this issue.(CVE-2026-46051)\n\nIn the Linux kernel, the following vulnerability has been resolved:  KVM: nSVM: Raise #UD if unhandled VMMCALL isn\u0026apos;t intercepted by L1  Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1.  The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it\u0026apos;s not intercepted.  Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses.  The last remaining \u0026quot;single\u0026quot; stub will soon be dropped as well.  [sean: rewrite changelog and comment, tag for stable, remove defunct stubs]  The Linux kernel CVE team has assigned CVE-2026-46076 to this issue.(CVE-2026-46076)\n\nIn the Linux kernel, the following vulnerability has been resolved:  erofs: fix the out-of-bounds nameoff handling for trailing dirents  Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs.  If a crafted EROFS has a trailing dirent with nameoff \u0026gt;= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block.  nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1].  [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com  The Linux kernel CVE team has assigned CVE-2026-46078 to this issue.(CVE-2026-46078)\n\nIn the Linux kernel, the following vulnerability has been resolved:  KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0  INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0.  [sean: tag for stable@]  The Linux kernel CVE team has assigned CVE-2026-46082 to this issue.(CVE-2026-46082)\n\nIn the Linux kernel, the following vulnerability has been resolved:  mm/vmalloc: take vmap_purge_lock in shrinker  decay_va_pool_node() can be invoked concurrently from two paths: __purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan().  However, decay_va_pool_node() is not safe to run concurrently, and the shrinker path currently lacks serialization, leading to races and possible leaks.  Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker path to ensure serialization with purge users.  The Linux kernel CVE team has assigned CVE-2026-46093 to this issue.(CVE-2026-46093)\n\nIn the Linux kernel, the following vulnerability has been resolved:mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lockPatch series \u0026quot;mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\u0026quot;.Reads of \u0026apos;memcg_path\u0026apos; and \u0026apos;path\u0026apos; files in DAMON sysfs interface could racewith their writes, results in use-after-free.  Fix those.This patch (of 2):damon_sysfs_scheme_filter-\u0026gt;mmecg_path can be read and written by users,via DAMON sysfs memcg_path file.  It can also be indirectly read, for theparameters {on,off}line committing to DAMON.  The reads for parameterscommitting are protected by damon_sysfs_lock to avoid the sysfs filesbeing destroyed while any of the parameters are being read.  But theuser-driven direct reads and writes are not protected by any lock, whilethe write is deallocating the memcg_path-pointing buffer.  As a result,the readers could read the already freed buffer (user-after-free).  Notethat the user-reads don\u0026apos;t race when the same open file is used by thewriter, due to kernfs\u0026apos;s open file locking.  Nonetheless, doing the readsand writes with separate open files would be common.  Fix it by protectingboth the user-direct reads and writes with damon_sysfs_lock.(CVE-2026-46121)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n\nhci_le_create_big_complete_evt() iterates over BT_BOUND connections for\na BIG handle using a while loop, accessing ev-\u0026gt;bis_handle[i++] on each\niteration.  However, there is no check that i stays within ev-\u0026gt;num_bis\nbefore the array access.\n\nWhen a controller sends a LE_Create_BIG_Complete event with fewer\nbis_handle entries than there are BT_BOUND connections for that BIG,\nor with num_bis=0, the loop reads beyond the valid bis_handle[] flex\narray into adjacent heap memory.  Since the out-of-bounds values\ntypically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()\nrejects them and the connection remains in BT_BOUND state.  The same\nconnection is then found again by hci_conn_hash_lookup_big_state(),\ncreating an infinite loop with hci_dev_lock held.\n\nFix this by terminating the BIG if in case not all BIS could be setup\nproperly.(CVE-2026-46138)\n\nIn the Linux kernel, vports are used concurrently and protected by RCU, so netdev_put() must happen after the RCU grace period. The rtnl_delete_link() must happen under RTNL and cannot be executed in RCU context. Calling synchronize_net() while holding RTNL is not good for performance and system stability, so calling netdev_put() in RCU call is the right solution. However, when the device is deleted, rtnl_unlock() calls netdev_run_todo() and blocks until all references are gone. In the current code, this means that call_rcu() is never reached, the vport is never freed, and the reference is never released, causing a self-deadlock on device removal. The fix moves the rcu_call() before rtnl_unlock(), so the scheduled RCU callback will be executed when synchronize_net() is called from rtnl_unlock()-\u0026gt;netdev_run_todo() while RTNL itself is already released.(CVE-2026-46165)\n\nIn the Linux kernel\u0026apos;s RISC-V KVM subsystem, when the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is not freed, causing a memory leak. An attacker can trigger this via ioctl(vm_fd, KVM_CREATE_VCPU), potentially leading to resource exhaustion.(CVE-2026-46171)\n\nIn the Linux kernel, the mlx4_ib_create_srq() function fails to release resources allocated by mlx4_srq_alloc() in error handling paths, leading to a resource leak. An attacker could exploit this vulnerability to cause resource exhaustion or denial of service.(CVE-2026-46178)\n\nIn the Linux kernel, the spi_nor_params_show() function uses sizeof(snor_f_names) to calculate the array length. Since snor_f_names is an array of pointers, sizeof returns the total byte size of the pointer array (element_count  sizeof(void )), which on 64-bit systems is 8 times larger than intended. This causes an out-of-bounds read when a flag bit is set that exceeds the actual element count but falls within the inflated byte-size count. The fix replaces sizeof with ARRAY_SIZE to pass the actual number of elements.(CVE-2026-46190)","status":"published","published":"2026-06-05T11:11:31Z","modified":"2026-08-18T01:20:04.171596141Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-43345","title":"CVE-2026-43345 in linux - Patched by Root","description":"Root has patched CVE-2026-43345 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:17:47.204381662Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:59:13.904931Z"},{"id":"UBUNTU-CVE-2026-43345","description":"In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.","status":"published","published":"2026-05-08T14:16:00Z","modified":"2026-11-06T13:52:02.637034536Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T14:24:23.919001Z"},{"id":"openSUSE-SU-2026:21388-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:32Z","modified":"2026-07-24T18:24:22.02722596Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22433-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Improve compatibility with awk 2.4.0 (bsc#1266214). \n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- wicked test: Added missing locking in backport (bsc#1267732).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T17:41:36Z","modified":"2026-07-03T18:24:21.036345246Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22436-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T23:09:03Z","modified":"2026-07-03T18:24:21.038473869Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22458-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Improve compatibility with awk 2.4.0 (bsc#1266214). \n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- wicked test: Added missing locking in backport (bsc#1267732).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T11:07:10Z","modified":"2026-07-04T18:24:20.416361045Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22460-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T16:55:30Z","modified":"2026-07-04T18:24:20.422336767Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22742-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-23T18:24:18.071402846Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22769-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-23T18:24:21.24177443Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22812-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:33Z","modified":"2026-07-28T18:24:06.778434145Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22835-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-28T18:24:09.217846062Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2722-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- ice: ptp: do not WARN when controlling PF is unavailable (bsc#1267251).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- scripts/submit_branch: add SLE15-SP7 submission script\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- watchdog: apple: Add 'apple,t8103-wdt' compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-07-01T13:35:33Z","modified":"2026-07-02T09:15:04.899939463Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2799-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Ultra definitions (bsc#1266290).\n- CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: hci_sync: Remove remaining dependencies of hci_request (bsc#1262993).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak\n  (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46150: fanotify: fix false positive on permission events.\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: crypto: caam - guard HMAC key hex dumps in hash_digest_key (bsc#1267937).\n- CVE-2026-46315: io_uring/waitid: clear waitid info before copying it to userspace (bsc#1267953).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).\n- CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).\n- CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops (bsc#1269281).\n- CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).\n- CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).\n- CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: xpad - add 'Nova 2 Lite' from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- iommu/s390: allow larger region tables (jsc#PED-15880).\n- iommu/s390: Fix memory corruption when using identity domain (jsc#PED-15880).\n- iommu/s390: handle IOAT registration based on domain (jsc#PED-15880).\n- iommu/s390: implement iommu passthrough via identity domain (jsc#PED-15880).\n- iommu/s390: set appropriate IOTA region type (jsc#PED-15880).\n- iommu/s390: support cleanup of additional table regions (jsc#PED-15880).\n- iommu/s390: support iova_to_phys for additional table regions (jsc#PED-15880).\n- iommu/s390: support map/unmap for additional table regions (jsc#PED-15880).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: s390: Limit adapter indicator access to mapped page (bsc#1268159).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303).\n- loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- module: fix init_module_from_file() error handling (jsc#PED-16303).\n- module: make waiting for a concurrent module loader interruptible (jsc#PED-16303).\n- module: Split modules_install compression and in-kernel decompression (jsc#PED-16303).\n- module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303).\n- module: warn about excessively long module waits (jsc#PED-16303).\n- modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- s390/pci: check for relaxed translation capability (jsc#PED-15880).\n- s390/pci: Fix dev.dma_range_map missing sentinel element (jsc#PED-15880).\n- s390/pci: store DMA offset in bus_dma_region (jsc#PED-15880).\n- scripts/submit_branch: add SLE15-SP7 submission script.\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (bsc#1269617).\n- selftests/bpf: Allow test_progs to link with a partial object set (bsc#1269617).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (bsc#1269617).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (bsc#1269617).\n- selftests/bpf: Provide weak definitions for cross-test functions (bsc#1269617).\n- selftests/bpf: Skip tests whose objects were not built (bsc#1269617).\n- selftests/bpf: Tolerate benchmark build failures (bsc#1269617).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (bsc#1269617).\n- selftests/bpf: Tolerate missing files during install (bsc#1269617).\n- selftests/bpf: Tolerate test file compilation failures (bsc#1269617).\n- serdev: make serdev_bus_type const (stable-fixes).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add 'apple,t8103-wdt' compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n","status":"published","published":"2026-07-08T14:58:16Z","modified":"2026-07-09T10:00:04.592679052Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8567-1","title":"linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,\nCVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,\nCVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,\nCVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,\nCVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,\nCVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,\nCVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,\nCVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,\nCVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,\nCVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,\nCVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,\nCVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,\nCVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,\nCVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,\nCVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,\nCVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,\nCVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,\nCVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,\nCVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,\nCVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,\nCVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,\nCVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,\nCVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,\nCVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,\nCVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,\nCVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,\nCVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,\nCVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,\nCVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,\nCVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,\nCVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,\nCVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,\nCVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,\nCVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,\nCVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,\nCVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372,\nCVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381,\nCVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395,\nCVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409,\nCVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495,\nCVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502,\nCVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838,\nCVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842,\nCVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846,\nCVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911,\nCVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986,\nCVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994,\nCVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002,\nCVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006,\nCVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012,\nCVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019,\nCVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,\nCVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033,\nCVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041,\nCVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,\nCVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,\nCVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,\nCVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,\nCVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,\nCVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,\nCVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,\nCVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,\nCVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,\nCVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,\nCVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,\nCVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,\nCVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120,\nCVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124,\nCVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128,\nCVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133,\nCVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139,\nCVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145,\nCVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,\nCVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160,\nCVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167,\nCVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173,\nCVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,\nCVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186,\nCVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280,\nCVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294,\nCVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303,\nCVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312,\nCVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920,\nCVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,\nCVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,\nCVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,\nCVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,\nCVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,\nCVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,\nCVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,\nCVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,\nCVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,\nCVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,\nCVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,\nCVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,\nCVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,\nCVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,\nCVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,\nCVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,\nCVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,\nCVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,\nCVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,\nCVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,\nCVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,\nCVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,\nCVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,\nCVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,\nCVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,\nCVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,\nCVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,\nCVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,\nCVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320)\n","status":"published","published":"2026-07-20T15:36:35Z","modified":"2026-11-07T01:46:48.030854859Z","updated_at":"2026-11-07T01:56:38.538236Z"},{"id":"USN-8574-1","title":"linux-gcp-fips vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,\nCVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,\nCVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,\nCVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,\nCVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,\nCVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,\nCVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,\nCVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,\nCVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,\nCVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,\nCVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,\nCVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,\nCVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,\nCVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,\nCVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,\nCVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,\nCVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,\nCVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,\nCVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,\nCVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,\nCVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,\nCVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,\nCVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,\nCVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,\nCVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,\nCVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,\nCVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,\nCVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,\nCVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,\nCVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,\nCVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,\nCVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,\nCVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,\nCVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,\nCVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,\nCVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372,\nCVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381,\nCVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395,\nCVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409,\nCVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495,\nCVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502,\nCVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838,\nCVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842,\nCVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846,\nCVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911,\nCVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986,\nCVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994,\nCVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002,\nCVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006,\nCVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012,\nCVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019,\nCVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,\nCVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033,\nCVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041,\nCVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,\nCVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,\nCVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,\nCVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,\nCVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,\nCVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,\nCVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,\nCVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,\nCVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,\nCVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,\nCVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,\nCVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,\nCVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120,\nCVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124,\nCVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128,\nCVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133,\nCVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139,\nCVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145,\nCVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,\nCVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160,\nCVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167,\nCVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173,\nCVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,\nCVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186,\nCVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280,\nCVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294,\nCVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303,\nCVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312,\nCVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920,\nCVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,\nCVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,\nCVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,\nCVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,\nCVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,\nCVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,\nCVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,\nCVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,\nCVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,\nCVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,\nCVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,\nCVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,\nCVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,\nCVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,\nCVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,\nCVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,\nCVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,\nCVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,\nCVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,\nCVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,\nCVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,\nCVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,\nCVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,\nCVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,\nCVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,\nCVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,\nCVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,\nCVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,\nCVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,\nCVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,\nCVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,\nCVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,\nCVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,\nCVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,\nCVE-2026-63865, CVE-2026-64164)\n","status":"published","published":"2026-07-21T09:51:58Z","modified":"2026-11-09T12:46:41.603455464Z","updated_at":"2026-11-07T01:57:16.198641Z"},{"id":"USN-8574-2","title":"linux-fips, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,\nCVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,\nCVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,\nCVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,\nCVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,\nCVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,\nCVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,\nCVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,\nCVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,\nCVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,\nCVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,\nCVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,\nCVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,\nCVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,\nCVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,\nCVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,\nCVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,\nCVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,\nCVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,\nCVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,\nCVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,\nCVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,\nCVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,\nCVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,\nCVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,\nCVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,\nCVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,\nCVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,\nCVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,\nCVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,\nCVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,\nCVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,\nCVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,\nCVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,\nCVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,\nCVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372,\nCVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381,\nCVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395,\nCVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409,\nCVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495,\nCVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502,\nCVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838,\nCVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842,\nCVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846,\nCVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911,\nCVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986,\nCVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994,\nCVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002,\nCVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006,\nCVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012,\nCVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019,\nCVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,\nCVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033,\nCVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041,\nCVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,\nCVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,\nCVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,\nCVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,\nCVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,\nCVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,\nCVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,\nCVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,\nCVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,\nCVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,\nCVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,\nCVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,\nCVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120,\nCVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124,\nCVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128,\nCVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133,\nCVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139,\nCVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145,\nCVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,\nCVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160,\nCVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167,\nCVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173,\nCVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,\nCVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186,\nCVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280,\nCVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294,\nCVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303,\nCVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312,\nCVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920,\nCVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,\nCVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,\nCVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,\nCVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,\nCVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,\nCVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,\nCVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,\nCVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,\nCVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,\nCVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,\nCVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,\nCVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,\nCVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,\nCVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,\nCVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,\nCVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,\nCVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,\nCVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,\nCVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,\nCVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,\nCVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,\nCVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,\nCVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,\nCVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,\nCVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,\nCVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,\nCVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,\nCVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,\nCVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,\nCVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,\nCVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,\nCVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,\nCVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,\nCVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,\nCVE-2026-63865, CVE-2026-64164)\n","status":"published","published":"2026-07-23T07:48:36Z","modified":"2026-11-09T12:48:51.609882158Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8574-3","title":"linux-ibm, linux-ibm-6.8, linux-nvidia-tegra, linux-xilinx vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,\nCVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,\nCVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,\nCVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,\nCVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,\nCVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,\nCVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,\nCVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,\nCVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,\nCVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,\nCVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,\nCVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,\nCVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,\nCVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,\nCVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,\nCVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,\nCVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,\nCVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,\nCVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,\nCVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,\nCVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,\nCVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,\nCVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,\nCVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,\nCVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,\nCVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,\nCVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,\nCVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,\nCVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,\nCVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,\nCVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,\nCVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,\nCVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,\nCVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,\nCVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,\nCVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372,\nCVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381,\nCVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395,\nCVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409,\nCVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495,\nCVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502,\nCVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838,\nCVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842,\nCVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846,\nCVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911,\nCVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986,\nCVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994,\nCVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002,\nCVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006,\nCVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012,\nCVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019,\nCVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,\nCVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033,\nCVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041,\nCVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,\nCVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,\nCVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,\nCVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,\nCVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,\nCVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,\nCVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,\nCVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,\nCVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,\nCVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,\nCVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,\nCVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,\nCVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120,\nCVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124,\nCVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128,\nCVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133,\nCVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139,\nCVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145,\nCVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,\nCVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160,\nCVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167,\nCVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173,\nCVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,\nCVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186,\nCVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280,\nCVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294,\nCVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303,\nCVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312,\nCVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920,\nCVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,\nCVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,\nCVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,\nCVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,\nCVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,\nCVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,\nCVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,\nCVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,\nCVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,\nCVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,\nCVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,\nCVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,\nCVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,\nCVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,\nCVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,\nCVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,\nCVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,\nCVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,\nCVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,\nCVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,\nCVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,\nCVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,\nCVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,\nCVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,\nCVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,\nCVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,\nCVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,\nCVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,\nCVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,\nCVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,\nCVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,\nCVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,\nCVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,\nCVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,\nCVE-2026-63865, CVE-2026-64164)\n","status":"published","published":"2026-07-28T07:23:25Z","modified":"2026-11-09T12:49:17.012782847Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8595-1","title":"linux-oracle-6.8 vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,\nCVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,\nCVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,\nCVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,\nCVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,\nCVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,\nCVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,\nCVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,\nCVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,\nCVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,\nCVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,\nCVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,\nCVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,\nCVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,\nCVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,\nCVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,\nCVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,\nCVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,\nCVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,\nCVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,\nCVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,\nCVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,\nCVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,\nCVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,\nCVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,\nCVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,\nCVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,\nCVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,\nCVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,\nCVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64164)\n","status":"published","published":"2026-07-23T07:57:09Z","modified":"2026-11-09T12:46:39.626735177Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8595-2","title":"linux-aws vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,\nCVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,\nCVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,\nCVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,\nCVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,\nCVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,\nCVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,\nCVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,\nCVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,\nCVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,\nCVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,\nCVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,\nCVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,\nCVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,\nCVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,\nCVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,\nCVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,\nCVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,\nCVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,\nCVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,\nCVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,\nCVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,\nCVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,\nCVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,\nCVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,\nCVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,\nCVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,\nCVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,\nCVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,\nCVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64164)\n","status":"published","published":"2026-07-24T10:14:09Z","modified":"2026-11-09T12:46:40.833371554Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8595-3","title":"linux-aws-6.8, linux-aws-fips vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,\nCVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,\nCVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,\nCVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,\nCVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,\nCVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,\nCVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,\nCVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,\nCVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,\nCVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,\nCVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,\nCVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,\nCVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,\nCVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,\nCVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,\nCVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,\nCVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,\nCVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,\nCVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,\nCVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,\nCVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,\nCVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,\nCVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,\nCVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,\nCVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,\nCVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,\nCVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,\nCVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,\nCVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,\nCVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64164)\n","status":"published","published":"2026-07-28T07:25:50Z","modified":"2026-11-09T12:49:11.651297869Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8596-1","title":"linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23226, CVE-2026-23227, CVE-2026-23244, CVE-2026-23245,\nCVE-2026-23246, CVE-2026-23253, CVE-2026-23255, CVE-2026-23270,\nCVE-2026-23271, CVE-2026-23276, CVE-2026-23277, CVE-2026-23279,\nCVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286,\nCVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291,\nCVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298,\nCVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304,\nCVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310,\nCVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317,\nCVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324,\nCVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335,\nCVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343,\nCVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357,\nCVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362,\nCVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367,\nCVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372,\nCVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379,\nCVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386,\nCVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391,\nCVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398,\nCVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413,\nCVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420,\nCVE-2026-23426, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439,\nCVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444,\nCVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449,\nCVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457,\nCVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462,\nCVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468,\nCVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389,\nCVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394,\nCVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31403,\nCVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409,\nCVE-2026-31412, CVE-2026-31413, CVE-2026-31414, CVE-2026-31415,\nCVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422,\nCVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426,\nCVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430,\nCVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31438,\nCVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446,\nCVE-2026-31447, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,\nCVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,\nCVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,\nCVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,\nCVE-2026-31476, CVE-2026-31477, CVE-2026-31480, CVE-2026-31482,\nCVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488,\nCVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495,\nCVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499,\nCVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505,\nCVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,\nCVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,\nCVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,\nCVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,\nCVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,\nCVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,\nCVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,\nCVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,\nCVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,\nCVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,\nCVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,\nCVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,\nCVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,\nCVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,\nCVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,\nCVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,\nCVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,\nCVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,\nCVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,\nCVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,\nCVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,\nCVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,\nCVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,\nCVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,\nCVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,\nCVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,\nCVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,\nCVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,\nCVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,\nCVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53354,\nCVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,\nCVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,\nCVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,\nCVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,\nCVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,\nCVE-2026-63865, CVE-2026-64164)\n","status":"published","published":"2026-07-23T08:06:00Z","modified":"2026-11-09T12:48:44.712103783Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8606-1","title":"linux-azure, linux-azure-6.8 vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - RNBD block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Multifunction device drivers;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - RAS (Reliability, Availability, Serviceability) subsystem;\n  - Remote Processor subsystem;\n  - RPMSG subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - MediaTek SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Proc file system;\n  - Pstore file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Audit subsystem;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - Kernel kexec() syscall;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - RCU subsystem;\n  - Scheduler infrastructure;\n  - Cryptographic library;\n  - Scatterlist API;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - AppArmor security module;\n  - Landlock security;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,\nCVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,\nCVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,\nCVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,\nCVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,\nCVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,\nCVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,\nCVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,\nCVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,\nCVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,\nCVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,\nCVE-2026-23169, CVE-2026-23171, CVE-2026-23207, CVE-2026-23220,\nCVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227,\nCVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233,\nCVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,\nCVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,\nCVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249,\nCVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276,\nCVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281,\nCVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287,\nCVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292,\nCVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300,\nCVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306,\nCVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312,\nCVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318,\nCVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325,\nCVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336,\nCVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347,\nCVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359,\nCVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363,\nCVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368,\nCVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374,\nCVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381,\nCVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387,\nCVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392,\nCVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398,\nCVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413,\nCVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420,\nCVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454,\nCVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458,\nCVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463,\nCVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470,\nCVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391,\nCVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396,\nCVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403,\nCVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409,\nCVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415,\nCVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440,\nCVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448,\nCVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452,\nCVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458,\nCVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469,\nCVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476,\nCVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482,\nCVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488,\nCVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495,\nCVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499,\nCVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505,\nCVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638,\nCVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646,\nCVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655,\nCVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669,\nCVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,\nCVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678,\nCVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686,\nCVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694,\nCVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698,\nCVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702,\nCVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720,\nCVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724,\nCVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729,\nCVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738,\nCVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748,\nCVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,\nCVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,\nCVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767,\nCVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773,\nCVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781,\nCVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038,\nCVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044,\nCVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050,\nCVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056,\nCVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060,\nCVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065,\nCVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071,\nCVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075,\nCVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081,\nCVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088,\nCVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093,\nCVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,\nCVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109,\nCVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113,\nCVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129,\nCVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,\nCVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139,\nCVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,\nCVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150,\nCVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157,\nCVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163,\nCVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,\nCVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,\nCVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185,\nCVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190,\nCVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,\nCVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,\nCVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,\nCVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,\nCVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,\nCVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,\nCVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,\nCVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,\nCVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,\nCVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,\nCVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258,\nCVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265,\nCVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,\nCVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,\nCVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,\nCVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291,\nCVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,\nCVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313,\nCVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317,\nCVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341,\nCVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350,\nCVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360,\nCVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,\nCVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381,\nCVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386,\nCVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405,\nCVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409,\nCVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414,\nCVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421,\nCVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427,\nCVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432,\nCVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441,\nCVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450,\nCVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455,\nCVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459,\nCVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469,\nCVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475,\nCVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484,\nCVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497,\nCVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847,\nCVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,\nCVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858,\nCVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,\nCVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867,\nCVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871,\nCVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,\nCVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881,\nCVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885,\nCVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,\nCVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904,\nCVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912,\nCVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916,\nCVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921,\nCVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935,\nCVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942,\nCVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948,\nCVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958,\nCVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965,\nCVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972,\nCVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,\nCVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984,\nCVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043,\nCVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,\nCVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,\nCVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,\nCVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,\nCVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,\nCVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,\nCVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,\nCVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,\nCVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,\nCVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,\nCVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,\nCVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,\nCVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117,\nCVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122,\nCVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126,\nCVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131,\nCVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186,\nCVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196,\nCVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200,\nCVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206,\nCVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211,\nCVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219,\nCVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227,\nCVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232,\nCVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236,\nCVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244,\nCVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250,\nCVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255,\nCVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265,\nCVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273,\nCVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285,\nCVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920,\nCVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,\nCVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,\nCVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,\nCVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,\nCVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,\nCVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,\nCVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,\nCVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,\nCVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,\nCVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,\nCVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,\nCVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,\nCVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,\nCVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,\nCVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,\nCVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,\nCVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,\nCVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,\nCVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,\nCVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,\nCVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,\nCVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,\nCVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,\nCVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,\nCVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,\nCVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,\nCVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,\nCVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,\nCVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,\nCVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,\nCVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,\nCVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,\nCVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,\nCVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,\nCVE-2026-63865, CVE-2026-64018, CVE-2026-64034)\n","status":"published","published":"2026-07-24T10:17:16Z","modified":"2026-11-07T01:46:10.910402805Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8607-1","title":"linux-azure-fde vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - RNBD block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Multifunction device drivers;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - RAS (Reliability, Availability, Serviceability) subsystem;\n  - Remote Processor subsystem;\n  - RPMSG subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - MediaTek SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Proc file system;\n  - Pstore file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Audit subsystem;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - Kernel kexec() syscall;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - RCU subsystem;\n  - Scheduler infrastructure;\n  - Cryptographic library;\n  - Scatterlist API;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - AppArmor security module;\n  - Landlock security;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,\nCVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,\nCVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,\nCVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,\nCVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,\nCVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,\nCVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,\nCVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,\nCVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,\nCVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,\nCVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,\nCVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,\nCVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,\nCVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,\nCVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,\nCVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,\nCVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,\nCVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,\nCVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,\nCVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,\nCVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,\nCVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,\nCVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,\nCVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,\nCVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,\nCVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,\nCVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,\nCVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,\nCVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,\nCVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,\nCVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,\nCVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,\nCVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,\nCVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,\nCVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,\nCVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,\nCVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,\nCVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,\nCVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,\nCVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,\nCVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,\nCVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,\nCVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,\nCVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,\nCVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,\nCVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,\nCVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,\nCVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,\nCVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,\nCVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,\nCVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,\nCVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,\nCVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,\nCVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,\nCVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,\nCVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,\nCVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,\nCVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,\nCVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,\nCVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,\nCVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,\nCVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,\nCVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,\nCVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,\nCVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,\nCVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,\nCVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,\nCVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,\nCVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,\nCVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,\nCVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,\nCVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,\nCVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,\nCVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,\nCVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,\nCVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,\nCVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,\nCVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,\nCVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,\nCVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,\nCVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,\nCVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,\nCVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,\nCVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,\nCVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,\nCVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,\nCVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,\nCVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,\nCVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,\nCVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,\nCVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,\nCVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,\nCVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,\nCVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,\nCVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,\nCVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,\nCVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,\nCVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,\nCVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,\nCVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,\nCVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,\nCVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,\nCVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,\nCVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,\nCVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,\nCVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,\nCVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,\nCVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,\nCVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,\nCVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,\nCVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,\nCVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,\nCVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,\nCVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,\nCVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,\nCVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,\nCVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,\nCVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,\nCVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,\nCVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,\nCVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,\nCVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,\nCVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,\nCVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,\nCVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,\nCVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,\nCVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,\nCVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,\nCVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,\nCVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,\nCVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,\nCVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,\nCVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,\nCVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,\nCVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,\nCVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,\nCVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,\nCVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,\nCVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,\nCVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,\nCVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,\nCVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,\nCVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,\nCVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,\nCVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,\nCVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,\nCVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,\nCVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,\nCVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,\nCVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,\nCVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,\nCVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,\nCVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,\nCVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,\nCVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,\nCVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,\nCVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,\nCVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64018, CVE-2026-64034)\n","status":"published","published":"2026-07-24T10:20:29Z","modified":"2026-11-07T01:46:01.058375657Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8608-1","title":"linux-azure-fips vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,\nCVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,\nCVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,\nCVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,\nCVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,\nCVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,\nCVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,\nCVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,\nCVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,\nCVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,\nCVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,\nCVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,\nCVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,\nCVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,\nCVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,\nCVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,\nCVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,\nCVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,\nCVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,\nCVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,\nCVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,\nCVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,\nCVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,\nCVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,\nCVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,\nCVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,\nCVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,\nCVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,\nCVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,\nCVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,\nCVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,\nCVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,\nCVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,\nCVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,\nCVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,\nCVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,\nCVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,\nCVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,\nCVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,\nCVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,\nCVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,\nCVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,\nCVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,\nCVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,\nCVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64018, CVE-2026-64034, CVE-2026-64164)\n","status":"published","published":"2026-07-24T10:23:19Z","modified":"2026-11-09T12:47:05.283755841Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8609-1","title":"linux-azure-fde-6.8 vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - RNBD block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Multifunction device drivers;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - RAS (Reliability, Availability, Serviceability) subsystem;\n  - Remote Processor subsystem;\n  - RPMSG subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - MediaTek SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Proc file system;\n  - Pstore file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Audit subsystem;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - Kernel kexec() syscall;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - RCU subsystem;\n  - Scheduler infrastructure;\n  - Cryptographic library;\n  - Scatterlist API;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - AppArmor security module;\n  - Landlock security;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,\nCVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,\nCVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,\nCVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,\nCVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,\nCVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,\nCVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,\nCVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,\nCVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,\nCVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,\nCVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,\nCVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,\nCVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,\nCVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,\nCVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,\nCVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,\nCVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,\nCVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,\nCVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,\nCVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,\nCVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,\nCVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,\nCVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,\nCVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,\nCVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,\nCVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,\nCVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,\nCVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,\nCVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,\nCVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,\nCVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,\nCVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,\nCVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,\nCVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,\nCVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,\nCVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,\nCVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,\nCVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,\nCVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,\nCVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,\nCVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,\nCVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,\nCVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,\nCVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,\nCVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,\nCVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,\nCVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,\nCVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,\nCVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,\nCVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,\nCVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,\nCVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,\nCVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,\nCVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,\nCVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,\nCVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,\nCVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,\nCVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,\nCVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,\nCVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,\nCVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,\nCVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,\nCVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,\nCVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,\nCVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,\nCVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,\nCVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,\nCVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,\nCVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,\nCVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,\nCVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,\nCVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,\nCVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,\nCVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,\nCVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,\nCVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,\nCVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,\nCVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,\nCVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,\nCVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,\nCVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,\nCVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,\nCVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,\nCVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,\nCVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,\nCVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,\nCVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,\nCVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,\nCVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,\nCVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,\nCVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,\nCVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,\nCVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,\nCVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,\nCVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,\nCVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,\nCVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,\nCVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,\nCVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,\nCVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,\nCVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,\nCVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,\nCVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,\nCVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,\nCVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,\nCVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,\nCVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,\nCVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,\nCVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,\nCVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,\nCVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,\nCVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,\nCVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,\nCVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,\nCVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,\nCVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,\nCVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,\nCVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,\nCVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,\nCVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,\nCVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,\nCVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,\nCVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,\nCVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,\nCVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,\nCVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,\nCVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,\nCVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,\nCVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,\nCVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,\nCVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,\nCVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,\nCVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,\nCVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,\nCVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,\nCVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,\nCVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,\nCVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,\nCVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,\nCVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,\nCVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,\nCVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,\nCVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,\nCVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,\nCVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,\nCVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,\nCVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,\nCVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,\nCVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,\nCVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,\nCVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,\nCVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,\nCVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,\nCVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,\nCVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,\nCVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,\nCVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,\nCVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,\nCVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,\nCVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,\nCVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,\nCVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,\nCVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,\nCVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,\nCVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,\nCVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,\nCVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,\nCVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,\nCVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,\nCVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,\nCVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,\nCVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,\nCVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,\nCVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,\nCVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,\nCVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,\nCVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,\nCVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,\nCVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,\nCVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,\nCVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,\nCVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,\nCVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,\nCVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,\nCVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,\nCVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,\nCVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,\nCVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,\nCVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,\nCVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,\nCVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,\nCVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,\nCVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,\nCVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,\nCVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,\nCVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,\nCVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,\nCVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,\nCVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,\nCVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,\nCVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,\nCVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,\nCVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,\nCVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,\nCVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,\nCVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,\nCVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,\nCVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,\nCVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,\nCVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,\nCVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,\nCVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,\nCVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,\nCVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,\nCVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,\nCVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,\nCVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,\nCVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,\nCVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,\nCVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,\nCVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,\nCVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,\nCVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,\nCVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,\nCVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,\nCVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,\nCVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,\nCVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,\nCVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,\nCVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,\nCVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,\nCVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,\nCVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,\nCVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,\nCVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,\nCVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,\nCVE-2026-64018, CVE-2026-64034, CVE-2026-64164)\n","status":"published","published":"2026-07-24T10:26:03Z","modified":"2026-11-07T01:45:29.525006235Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8619-1","title":"linux-hwe-6.8 vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - RNBD block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Multifunction device drivers;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - RAS (Reliability, Availability, Serviceability) subsystem;\n  - Remote Processor subsystem;\n  - RPMSG subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - MediaTek SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Proc file system;\n  - Pstore file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Audit subsystem;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - Kernel kexec() syscall;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - RCU subsystem;\n  - Scheduler infrastructure;\n  - Cryptographic library;\n  - Scatterlist API;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - AppArmor security module;\n  - Landlock security;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,\nCVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,\nCVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,\nCVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,\nCVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,\nCVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,\nCVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,\nCVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,\nCVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,\nCVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,\nCVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,\nCVE-2026-23169, CVE-2026-23171, CVE-2026-23207, CVE-2026-23220,\nCVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227,\nCVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233,\nCVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,\nCVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,\nCVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249,\nCVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276,\nCVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281,\nCVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287,\nCVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292,\nCVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300,\nCVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306,\nCVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312,\nCVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318,\nCVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325,\nCVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336,\nCVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347,\nCVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359,\nCVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363,\nCVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368,\nCVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374,\nCVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381,\nCVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387,\nCVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392,\nCVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398,\nCVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413,\nCVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420,\nCVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454,\nCVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458,\nCVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463,\nCVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470,\nCVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391,\nCVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396,\nCVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403,\nCVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409,\nCVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415,\nCVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440,\nCVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448,\nCVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452,\nCVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458,\nCVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469,\nCVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476,\nCVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482,\nCVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488,\nCVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495,\nCVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499,\nCVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505,\nCVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,\nCVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,\nCVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,\nCVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,\nCVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,\nCVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638,\nCVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646,\nCVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655,\nCVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659,\nCVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,\nCVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669,\nCVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,\nCVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678,\nCVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686,\nCVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694,\nCVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698,\nCVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702,\nCVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720,\nCVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724,\nCVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729,\nCVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738,\nCVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748,\nCVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,\nCVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,\nCVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767,\nCVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773,\nCVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781,\nCVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038,\nCVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044,\nCVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050,\nCVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056,\nCVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060,\nCVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065,\nCVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071,\nCVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075,\nCVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081,\nCVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088,\nCVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093,\nCVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,\nCVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109,\nCVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113,\nCVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129,\nCVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,\nCVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139,\nCVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,\nCVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150,\nCVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157,\nCVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163,\nCVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,\nCVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,\nCVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185,\nCVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190,\nCVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,\nCVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,\nCVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,\nCVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,\nCVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,\nCVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,\nCVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,\nCVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,\nCVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,\nCVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,\nCVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258,\nCVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265,\nCVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,\nCVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,\nCVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,\nCVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291,\nCVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,\nCVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313,\nCVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317,\nCVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324,\nCVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,\nCVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,\nCVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341,\nCVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350,\nCVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360,\nCVE-2026-43361, CVE-2026-43362, CVE-2026-43363, CVE-2026-43365,\nCVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43372,\nCVE-2026-43373, CVE-2026-43377, CVE-2026-43378, CVE-2026-43380,\nCVE-2026-43381, CVE-2026-43382, CVE-2026-43383, CVE-2026-43384,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43406, CVE-2026-43407, CVE-2026-43408,\nCVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413,\nCVE-2026-43414, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420,\nCVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426,\nCVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430,\nCVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439,\nCVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449,\nCVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453,\nCVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458,\nCVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468,\nCVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473,\nCVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483,\nCVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491,\nCVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43501, CVE-2026-43502,\nCVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838,\nCVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842,\nCVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846,\nCVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851,\nCVE-2026-45852, CVE-2026-45855, CVE-2026-45856, CVE-2026-45857,\nCVE-2026-45858, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861,\nCVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866,\nCVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870,\nCVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875,\nCVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880,\nCVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884,\nCVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891,\nCVE-2026-45893, CVE-2026-45895, CVE-2026-45899, CVE-2026-45902,\nCVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45911,\nCVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915,\nCVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45920,\nCVE-2026-45921, CVE-2026-45923, CVE-2026-45924, CVE-2026-45928,\nCVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941,\nCVE-2026-45942, CVE-2026-45943, CVE-2026-45946, CVE-2026-45947,\nCVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45957,\nCVE-2026-45958, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964,\nCVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970,\nCVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976,\nCVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983,\nCVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45988, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994,\nCVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002,\nCVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006,\nCVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012,\nCVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019,\nCVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,\nCVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033,\nCVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041,\nCVE-2026-46043, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047,\nCVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,\nCVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061,\nCVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,\nCVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072,\nCVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,\nCVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082,\nCVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088,\nCVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092,\nCVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101,\nCVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107,\nCVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112,\nCVE-2026-46113, CVE-2026-46114, CVE-2026-46115, CVE-2026-46116,\nCVE-2026-46117, CVE-2026-46119, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46135,\nCVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139,\nCVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145,\nCVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,\nCVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160,\nCVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167,\nCVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173,\nCVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,\nCVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46185,\nCVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190,\nCVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46195,\nCVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199,\nCVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205,\nCVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209,\nCVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218,\nCVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226,\nCVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231,\nCVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235,\nCVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46243,\nCVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249,\nCVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254,\nCVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261,\nCVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270,\nCVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,\nCVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46289,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294,\nCVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303,\nCVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312,\nCVE-2026-46314, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911,\nCVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936,\nCVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957,\nCVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963,\nCVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969,\nCVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977,\nCVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985,\nCVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992,\nCVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999,\nCVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004,\nCVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013,\nCVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021,\nCVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033,\nCVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037,\nCVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043,\nCVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048,\nCVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056,\nCVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061,\nCVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065,\nCVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071,\nCVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075,\nCVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083,\nCVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088,\nCVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097,\nCVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112,\nCVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123,\nCVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279,\nCVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293,\nCVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303,\nCVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314,\nCVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375,\nCVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843,\nCVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847,\nCVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854,\nCVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861,\nCVE-2026-63862, CVE-2026-63865)\n","status":"published","published":"2026-07-28T07:28:45Z","modified":"2026-11-07T01:45:56.683802514Z","updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"USN-8665-1","title":"linux-raspi, linux-raspi-realtime vulnerabilities","description":"It was discovered that some AMD processors did not properly clear data in\nthe floating point divider unit during speculative execution. A local\nattacker could use this to expose sensitive information. (CVE-2025-54505)\n\nIt was discovered that some AMD Zen 2 processors did not properly isolate\nshared resources in the operation cache. A local attacker could possibly\nuse this issue to corrupt instructions executed at a higher privilege\nlevel, resulting in privilege escalation. (CVE-2025-54518)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - Power management core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - EFI core;\n  - GPU drivers;\n  - Greybus drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - MediaTek SMI driver;\n  - NVIDIA Tegra memory controller driver;\n  - Fastrpc Driver;\n  - IBM Advanced System Management driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Broadcom BCM2835 power domain driver;\n  - Generic PM domains;\n  - i.MX PM domains;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - Freescale SoC drivers;\n  - Microchip PolarFire SoC system controller driver;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - SM750 framebuffer staging driver;\n  - TCM subsystem;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB YUREX driver;\n  - Renesas USBHS Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Framebuffer layer;\n  - TSM TDX Guest driver;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file systems library;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Kernel CPU control infrastructure;\n  - QorIQ DPAA2 FSL-MC bus driver;\n  - Memory Management;\n  - Integrity Measurement Architecture(IMA) framework;\n  - KVM subsystem;\n  - Memory management;\n  - Networking core;\n  - padata parallel execution mechanism;\n  - PPP protocol drivers and compressors;\n  - Linux Security Modules (LSM) Framework;\n  - Tracing infrastructure;\n  - Network traffic control;\n  - Distributed Switch Architecture;\n  - IPv4 networking;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - Netfilter;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KProbes tracing;\n  - Locking primitives;\n  - Kernel module support;\n  - Padata parallel execution mechanism;\n  - Cryptographic library;\n  - Heterogeneous memory management;\n  - KASAN memory debugging framework;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - IPv6 networking;\n  - XFRM subsystem;\n  - L2TP protocol;\n  - Management Component Transport Protocol (MCTP);\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RF switch subsystem;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - SCTP protocol;\n  - SMC sockets;\n  - Stream parser;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - Landlock security;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - QCOM ASoC drivers;\n  - Renesas ASoC drivers;\n  - Samsung ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - STI ASoC drivers;\n  - USB sound devices;\n  - Objtool;\n(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,\nCVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,\nCVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,\nCVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,\nCVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,\nCVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,\nCVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,\nCVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,\nCVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,\nCVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,\nCVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,\nCVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,\nCVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,\nCVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,\nCVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,\nCVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,\nCVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,\nCVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,\nCVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,\nCVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,\nCVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,\nCVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,\nCVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,\nCVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,\nCVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,\nCVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,\nCVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,\nCVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,\nCVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,\nCVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,\nCVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,\nCVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,\nCVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,\nCVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,\nCVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,\nCVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,\nCVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,\nCVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,\nCVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,\nCVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,\nCVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,\nCVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,\nCVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,\nCVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,\nCVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,\nCVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,\nCVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,\nCVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,\nCVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,\nCVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,\nCVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,\nCVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,\nCVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,\nCVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,\nCVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,\nCVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,\nCVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,\nCVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,\nCVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,\nCVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,\nCVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,\nCVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,\nCVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,\nCVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,\nCVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,\nCVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,\nCVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,\nCVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,\nCVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,\nCVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,\nCVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,\nCVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,\nCVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,\nCVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,\nCVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,\nCVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,\nCVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,\nCVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,\nCVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,\nCVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,\nCVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,\nCVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,\nCVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,\nCVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,\nCVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,\nCVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,\nCVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,\nCVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,\nCVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,\nCVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,\nCVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,\nCVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,\nCVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,\nCVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,\nCVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,\nCVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,\nCVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,\nCVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,\nCVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,\nCVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,\nCVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,\nCVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,\nCVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,\nCVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,\nCVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,\nCVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,\nCVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,\nCVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,\nCVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,\nCVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,\nCVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,\nCVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,\nCVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,\nCVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,\nCVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,\nCVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,\nCVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,\nCVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,\nCVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,\nCVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,\nCVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,\nCVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,\nCVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,\nCVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,\nCVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,\nCVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,\nCVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,\nCVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,\nCVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,\nCVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,\nCVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,\nCVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,\nCVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,\nCVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,\nCVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,\nCVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,\nCVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,\nCVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,\nCVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,\nCVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,\nCVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,\nCVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,\nCVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,\nCVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,\nCVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,\nCVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,\nCVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,\nCVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,\nCVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,\nCVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,\nCVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,\nCVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,\nCVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,\nCVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,\nCVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,\nCVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,\nCVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,\nCVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,\nCVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,\nCVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,\nCVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,\nCVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,\nCVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,\nCVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,\nCVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,\nCVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,\nCVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,\nCVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,\nCVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,\nCVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,\nCVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,\nCVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,\nCVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,\nCVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,\nCVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,\nCVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,\nCVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,\nCVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,\nCVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,\nCVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199,\nCVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205,\nCVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209,\nCVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218,\nCVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226,\nCVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231,\nCVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235,\nCVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46273,\nCVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285,\nCVE-2026-46286, CVE-2026-46287, CVE-2026-46291, CVE-2026-46292,\nCVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,\nCVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,\nCVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,\nCVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933,\nCVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955,\nCVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962,\nCVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968,\nCVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975,\nCVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984,\nCVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990,\nCVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998,\nCVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003,\nCVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012,\nCVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016,\nCVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032,\nCVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036,\nCVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041,\nCVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047,\nCVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052,\nCVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060,\nCVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064,\nCVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069,\nCVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074,\nCVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082,\nCVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086,\nCVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096,\nCVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111,\nCVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122,\nCVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130,\nCVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291,\nCVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296,\nCVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309,\nCVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374,\nCVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838,\nCVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846,\nCVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852,\nCVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860,\nCVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64164,\nCVE-2026-64587)\n","status":"published","published":"2026-08-20T23:31:14Z","modified":"2026-11-09T12:48:40.63232576Z","updated_at":"2026-11-07T01:56:47.245871Z"}]}}