{"id":"CVE-2026-43470","aliases":["BELL-CVE-2026-43470","DEBIAN-CVE-2026-43470","EUVD-2026-28776","GHSA-jprv-4f6g-4wvm","OESA-2026-2418","OESA-2026-2493","SUSE-SU-2026:22108-1","SUSE-SU-2026:22137-1","SUSE-SU-2026:22433-1","SUSE-SU-2026:22458-1","SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:2482-1","SUSE-SU-2026:2591-1","UBUNTU-CVE-2026-43470","openSUSE-SU-2026:21388-1"],"status":"published","title":"nfs: return EISDIR on nfs3_proc_create if d_alias is a dir","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00116,"percentile":0.01634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-05-08T14:22:30Z","modified":"2026-11-11T09:39:48Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.80-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.12.78","6.18.19","6.19.9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.85-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.19.10-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.74-r0"},{"fixed":"6.12.80-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.0"},{"fixed":"6.12.78"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.19"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.10-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.1.12.150.oe2403sp1"}]}],"bundled":122},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.0.13.139.oe2403"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1.21.24"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1.21.24"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"bundled":169},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1.150700.17.35.4"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.2"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.2"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.5.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.1"}]}],"bundled":102},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1","6.17.0-1009.9~24.04.3","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1016.17~24.04.1","6.17.0-1018.19~24.04.1","6.17.0-1020.22~24.04.1","6.17.0-1021.24~24.04.1","6.17.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14~24.04.1","6.17.0-19.19~24.04.2","6.17.0-20.20~24.04.1","6.17.0-22.22~24.04.1","6.17.0-23.23~24.04.1","6.17.0-29.29~24.04.1","6.17.0-35.35~24.04.1","6.17.0-40.40~24.04.1","6.17.0-41.41~24.04.1","6.17.0-42.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14","6.17.0-1018.18","6.17.0-1021.21","6.17.0-1026.26","6.17.0-1029.29","6.17.0-1031.31","6.17.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1017.17","6.17.0-1020.20","6.17.0-1023.23","6.17.0-1024.24","6.17.0-1025.25","6.17.0-1028.28","6.17.0-1030.30","6.17.0-1032.32","6.17.0-1033.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.1","6.17.0-1014.14~24.04.1","6.17.0-1016.16~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1019.19~24.04.3","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14","6.17.0-19.19","6.17.0-20.20","6.17.0-22.22","6.17.0-23.23","6.17.0-29.29","6.17.0-35.35","6.17.0-40.40"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1016.17","6.17.0-1018.19","6.17.0-1020.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1016.16","6.17.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1014.14","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7","6.17.0-1008.9","6.17.0-1009.10","6.17.0-1010.11","6.17.0-1011.12","6.17.0-1013.15","6.17.0-1014.16","6.17.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1","6.17.0-14.14.1","6.17.0-19.19.1","6.17.0-20.20.1","6.17.0-22.22.1","6.17.0-23.23.1","6.17.0-29.29.1","6.17.0-35.35.1","6.17.0-40.40.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1.160000.2.17"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.36.1"}]}],"bundled":255}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/7e2963773760a664684435201960dd2fb712f1b5","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/203c792cb4315360d49973ae2e57feeb6d3dcf7e","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/9ee1770fcb2f1b48354622b926e7dc10222805f5","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/410666a298c34ebd57256fde6b24c96bd23059a2","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43470","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jprv-4f6g-4wvm"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-43470","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43470.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43470","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37748","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38721","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40062","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23260","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43407","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43134","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43492","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622108-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248235","tags":["report"]},{"url":"https://bugzilla.suse.com/1255416","tags":["report"]},{"url":"https://bugzilla.suse.com/1258538","tags":["report"]},{"url":"https://bugzilla.suse.com/1260502","tags":["report"]},{"url":"https://bugzilla.suse.com/1260584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261619","tags":["report"]},{"url":"https://bugzilla.suse.com/1261791","tags":["report"]},{"url":"https://bugzilla.suse.com/1262606","tags":["report"]},{"url":"https://bugzilla.suse.com/1262615","tags":["report"]},{"url":"https://bugzilla.suse.com/1262619","tags":["report"]},{"url":"https://bugzilla.suse.com/1262622","tags":["report"]},{"url":"https://bugzilla.suse.com/1262624","tags":["report"]},{"url":"https://bugzilla.suse.com/1262634","tags":["report"]},{"url":"https://bugzilla.suse.com/1262649","tags":["report"]},{"url":"https://bugzilla.suse.com/1262656","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1262668","tags":["report"]},{"url":"https://bugzilla.suse.com/1262755","tags":["report"]},{"url":"https://bugzilla.suse.com/1263006","tags":["report"]},{"url":"https://bugzilla.suse.com/1263068","tags":["report"]},{"url":"https://bugzilla.suse.com/1263115","tags":["report"]},{"url":"https://bugzilla.suse.com/1263143","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263169","tags":["report"]},{"url":"https://bugzilla.suse.com/1263319","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263724","tags":["report"]},{"url":"https://bugzilla.suse.com/1263769","tags":["report"]},{"url":"https://bugzilla.suse.com/1263774","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263883","tags":["report"]},{"url":"https://bugzilla.suse.com/1263932","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1264000","tags":["report"]},{"url":"https://bugzilla.suse.com/1264011","tags":["report"]},{"url":"https://bugzilla.suse.com/1264063","tags":["report"]},{"url":"https://bugzilla.suse.com/1264091","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264243","tags":["report"]},{"url":"https://bugzilla.suse.com/1264245","tags":["report"]},{"url":"https://bugzilla.suse.com/1264255","tags":["report"]},{"url":"https://bugzilla.suse.com/1264300","tags":["report"]},{"url":"https://bugzilla.suse.com/1264409","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264449","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264484","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264669","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264672","tags":["report"]},{"url":"https://bugzilla.suse.com/1264716","tags":["report"]},{"url":"https://bugzilla.suse.com/1264719","tags":["report"]},{"url":"https://bugzilla.suse.com/1264720","tags":["report"]},{"url":"https://bugzilla.suse.com/1264722","tags":["report"]},{"url":"https://bugzilla.suse.com/1264726","tags":["report"]},{"url":"https://bugzilla.suse.com/1264765","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1264989","tags":["report"]},{"url":"https://bugzilla.suse.com/1265020","tags":["report"]},{"url":"https://bugzilla.suse.com/1265044","tags":["report"]},{"url":"https://bugzilla.suse.com/1265073","tags":["report"]},{"url":"https://bugzilla.suse.com/1265110","tags":["report"]},{"url":"https://bugzilla.suse.com/1265128","tags":["report"]},{"url":"https://bugzilla.suse.com/1265170","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265579","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1265960","tags":["report"]},{"url":"https://bugzilla.suse.com/1266001","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266214","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266307","tags":["report"]},{"url":"https://bugzilla.suse.com/1266394","tags":["report"]},{"url":"https://bugzilla.suse.com/1266395","tags":["report"]},{"url":"https://bugzilla.suse.com/1266400","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266414","tags":["report"]},{"url":"https://bugzilla.suse.com/1266452","tags":["report"]},{"url":"https://bugzilla.suse.com/1266696","tags":["report"]},{"url":"https://bugzilla.suse.com/1266697","tags":["report"]},{"url":"https://bugzilla.suse.com/1266711","tags":["report"]},{"url":"https://bugzilla.suse.com/1266720","tags":["report"]},{"url":"https://bugzilla.suse.com/1266759","tags":["report"]},{"url":"https://bugzilla.suse.com/1266765","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266810","tags":["report"]},{"url":"https://bugzilla.suse.com/1266816","tags":["report"]},{"url":"https://bugzilla.suse.com/1266826","tags":["report"]},{"url":"https://bugzilla.suse.com/1266827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266889","tags":["report"]},{"url":"https://bugzilla.suse.com/1266901","tags":["report"]},{"url":"https://bugzilla.suse.com/1266927","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1266972","tags":["report"]},{"url":"https://bugzilla.suse.com/1267205","tags":["report"]},{"url":"https://bugzilla.suse.com/1267214","tags":["report"]},{"url":"https://bugzilla.suse.com/1267218","tags":["report"]},{"url":"https://bugzilla.suse.com/1267220","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267531","tags":["report"]},{"url":"https://bugzilla.suse.com/1267626","tags":["report"]},{"url":"https://bugzilla.suse.com/1267652","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267732","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622137-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622433-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256668","tags":["report"]},{"url":"https://bugzilla.suse.com/1261256","tags":["report"]},{"url":"https://bugzilla.suse.com/1262085","tags":["report"]},{"url":"https://bugzilla.suse.com/1262392","tags":["report"]},{"url":"https://bugzilla.suse.com/1262617","tags":["report"]},{"url":"https://bugzilla.suse.com/1262620","tags":["report"]},{"url":"https://bugzilla.suse.com/1262674","tags":["report"]},{"url":"https://bugzilla.suse.com/1262748","tags":["report"]},{"url":"https://bugzilla.suse.com/1262798","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263123","tags":["report"]},{"url":"https://bugzilla.suse.com/1263137","tags":["report"]},{"url":"https://bugzilla.suse.com/1263178","tags":["report"]},{"url":"https://bugzilla.suse.com/1263563","tags":["report"]},{"url":"https://bugzilla.suse.com/1263568","tags":["report"]},{"url":"https://bugzilla.suse.com/1263578","tags":["report"]},{"url":"https://bugzilla.suse.com/1263879","tags":["report"]},{"url":"https://bugzilla.suse.com/1263880","tags":["report"]},{"url":"https://bugzilla.suse.com/1263930","tags":["report"]},{"url":"https://bugzilla.suse.com/1263934","tags":["report"]},{"url":"https://bugzilla.suse.com/1263993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263996","tags":["report"]},{"url":"https://bugzilla.suse.com/1264045","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264080","tags":["report"]},{"url":"https://bugzilla.suse.com/1264084","tags":["report"]},{"url":"https://bugzilla.suse.com/1264116","tags":["report"]},{"url":"https://bugzilla.suse.com/1264137","tags":["report"]},{"url":"https://bugzilla.suse.com/1264145","tags":["report"]},{"url":"https://bugzilla.suse.com/1264239","tags":["report"]},{"url":"https://bugzilla.suse.com/1264263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264266","tags":["report"]},{"url":"https://bugzilla.suse.com/1264437","tags":["report"]},{"url":"https://bugzilla.suse.com/1264444","tags":["report"]},{"url":"https://bugzilla.suse.com/1264470","tags":["report"]},{"url":"https://bugzilla.suse.com/1264549","tags":["report"]},{"url":"https://bugzilla.suse.com/1264561","tags":["report"]},{"url":"https://bugzilla.suse.com/1264595","tags":["report"]},{"url":"https://bugzilla.suse.com/1264603","tags":["report"]},{"url":"https://bugzilla.suse.com/1264610","tags":["report"]},{"url":"https://bugzilla.suse.com/1264741","tags":["report"]},{"url":"https://bugzilla.suse.com/1264763","tags":["report"]},{"url":"https://bugzilla.suse.com/1265103","tags":["report"]},{"url":"https://bugzilla.suse.com/1265143","tags":["report"]},{"url":"https://bugzilla.suse.com/1265628","tags":["report"]},{"url":"https://bugzilla.suse.com/1266290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266390","tags":["report"]},{"url":"https://bugzilla.suse.com/1266397","tags":["report"]},{"url":"https://bugzilla.suse.com/1266698","tags":["report"]},{"url":"https://bugzilla.suse.com/1266704","tags":["report"]},{"url":"https://bugzilla.suse.com/1266705","tags":["report"]},{"url":"https://bugzilla.suse.com/1266878","tags":["report"]},{"url":"https://bugzilla.suse.com/1266895","tags":["report"]},{"url":"https://bugzilla.suse.com/1266903","tags":["report"]},{"url":"https://bugzilla.suse.com/1266916","tags":["report"]},{"url":"https://bugzilla.suse.com/1266922","tags":["report"]},{"url":"https://bugzilla.suse.com/1266933","tags":["report"]},{"url":"https://bugzilla.suse.com/1267208","tags":["report"]},{"url":"https://bugzilla.suse.com/1267361","tags":["report"]},{"url":"https://bugzilla.suse.com/1267381","tags":["report"]},{"url":"https://bugzilla.suse.com/1267387","tags":["report"]},{"url":"https://bugzilla.suse.com/1267431","tags":["report"]},{"url":"https://bugzilla.suse.com/1267621","tags":["report"]},{"url":"https://bugzilla.suse.com/1267624","tags":["report"]},{"url":"https://bugzilla.suse.com/1267628","tags":["report"]},{"url":"https://bugzilla.suse.com/1267640","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267654","tags":["report"]},{"url":"https://bugzilla.suse.com/1267682","tags":["report"]},{"url":"https://bugzilla.suse.com/1267685","tags":["report"]},{"url":"https://bugzilla.suse.com/1267697","tags":["report"]},{"url":"https://bugzilla.suse.com/1267744","tags":["report"]},{"url":"https://bugzilla.suse.com/1268307","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622458-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622742-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149651","tags":["report"]},{"url":"https://bugzilla.suse.com/1204315","tags":["report"]},{"url":"https://bugzilla.suse.com/1236743","tags":["report"]},{"url":"https://bugzilla.suse.com/1255029","tags":["report"]},{"url":"https://bugzilla.suse.com/1257506","tags":["report"]},{"url":"https://bugzilla.suse.com/1259800","tags":["report"]},{"url":"https://bugzilla.suse.com/1260565","tags":["report"]},{"url":"https://bugzilla.suse.com/1261250","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1261604","tags":["report"]},{"url":"https://bugzilla.suse.com/1262430","tags":["report"]},{"url":"https://bugzilla.suse.com/1262618","tags":["report"]},{"url":"https://bugzilla.suse.com/1262765","tags":["report"]},{"url":"https://bugzilla.suse.com/1263057","tags":["report"]},{"url":"https://bugzilla.suse.com/1263072","tags":["report"]},{"url":"https://bugzilla.suse.com/1263133","tags":["report"]},{"url":"https://bugzilla.suse.com/1263573","tags":["report"]},{"url":"https://bugzilla.suse.com/1263581","tags":["report"]},{"url":"https://bugzilla.suse.com/1263796","tags":["report"]},{"url":"https://bugzilla.suse.com/1263998","tags":["report"]},{"url":"https://bugzilla.suse.com/1264001","tags":["report"]},{"url":"https://bugzilla.suse.com/1264007","tags":["report"]},{"url":"https://bugzilla.suse.com/1264010","tags":["report"]},{"url":"https://bugzilla.suse.com/1264012","tags":["report"]},{"url":"https://bugzilla.suse.com/1264015","tags":["report"]},{"url":"https://bugzilla.suse.com/1264056","tags":["report"]},{"url":"https://bugzilla.suse.com/1264067","tags":["report"]},{"url":"https://bugzilla.suse.com/1264230","tags":["report"]},{"url":"https://bugzilla.suse.com/1264231","tags":["report"]},{"url":"https://bugzilla.suse.com/1264236","tags":["report"]},{"url":"https://bugzilla.suse.com/1264241","tags":["report"]},{"url":"https://bugzilla.suse.com/1264250","tags":["report"]},{"url":"https://bugzilla.suse.com/1264254","tags":["report"]},{"url":"https://bugzilla.suse.com/1264258","tags":["report"]},{"url":"https://bugzilla.suse.com/1264261","tags":["report"]},{"url":"https://bugzilla.suse.com/1264270","tags":["report"]},{"url":"https://bugzilla.suse.com/1264286","tags":["report"]},{"url":"https://bugzilla.suse.com/1264294","tags":["report"]},{"url":"https://bugzilla.suse.com/1264295","tags":["report"]},{"url":"https://bugzilla.suse.com/1264302","tags":["report"]},{"url":"https://bugzilla.suse.com/1264304","tags":["report"]},{"url":"https://bugzilla.suse.com/1264320","tags":["report"]},{"url":"https://bugzilla.suse.com/1264328","tags":["report"]},{"url":"https://bugzilla.suse.com/1264333","tags":["report"]},{"url":"https://bugzilla.suse.com/1264337","tags":["report"]},{"url":"https://bugzilla.suse.com/1264372","tags":["report"]},{"url":"https://bugzilla.suse.com/1264386","tags":["report"]},{"url":"https://bugzilla.suse.com/1264429","tags":["report"]},{"url":"https://bugzilla.suse.com/1264532","tags":["report"]},{"url":"https://bugzilla.suse.com/1264544","tags":["report"]},{"url":"https://bugzilla.suse.com/1264545","tags":["report"]},{"url":"https://bugzilla.suse.com/1264548","tags":["report"]},{"url":"https://bugzilla.suse.com/1264556","tags":["report"]},{"url":"https://bugzilla.suse.com/1264580","tags":["report"]},{"url":"https://bugzilla.suse.com/1264612","tags":["report"]},{"url":"https://bugzilla.suse.com/1264614","tags":["report"]},{"url":"https://bugzilla.suse.com/1264624","tags":["report"]},{"url":"https://bugzilla.suse.com/1264643","tags":["report"]},{"url":"https://bugzilla.suse.com/1264734","tags":["report"]},{"url":"https://bugzilla.suse.com/1264740","tags":["report"]},{"url":"https://bugzilla.suse.com/1264744","tags":["report"]},{"url":"https://bugzilla.suse.com/1264789","tags":["report"]},{"url":"https://bugzilla.suse.com/1264790","tags":["report"]},{"url":"https://bugzilla.suse.com/1264794","tags":["report"]},{"url":"https://bugzilla.suse.com/1264852","tags":["report"]},{"url":"https://bugzilla.suse.com/1264974","tags":["report"]},{"url":"https://bugzilla.suse.com/1264978","tags":["report"]},{"url":"https://bugzilla.suse.com/1264997","tags":["report"]},{"url":"https://bugzilla.suse.com/1265000","tags":["report"]},{"url":"https://bugzilla.suse.com/1265005","tags":["report"]},{"url":"https://bugzilla.suse.com/1265023","tags":["report"]},{"url":"https://bugzilla.suse.com/1265079","tags":["report"]},{"url":"https://bugzilla.suse.com/1265082","tags":["report"]},{"url":"https://bugzilla.suse.com/1265084","tags":["report"]},{"url":"https://bugzilla.suse.com/1265091","tags":["report"]},{"url":"https://bugzilla.suse.com/1265097","tags":["report"]},{"url":"https://bugzilla.suse.com/1265112","tags":["report"]},{"url":"https://bugzilla.suse.com/1265113","tags":["report"]},{"url":"https://bugzilla.suse.com/1265123","tags":["report"]},{"url":"https://bugzilla.suse.com/1265129","tags":["report"]},{"url":"https://bugzilla.suse.com/1265142","tags":["report"]},{"url":"https://bugzilla.suse.com/1265629","tags":["report"]},{"url":"https://bugzilla.suse.com/1266008","tags":["report"]},{"url":"https://bugzilla.suse.com/1266283","tags":["report"]},{"url":"https://bugzilla.suse.com/1266284","tags":["report"]},{"url":"https://bugzilla.suse.com/1266396","tags":["report"]},{"url":"https://bugzilla.suse.com/1266398","tags":["report"]},{"url":"https://bugzilla.suse.com/1266458","tags":["report"]},{"url":"https://bugzilla.suse.com/1266686","tags":["report"]},{"url":"https://bugzilla.suse.com/1266693","tags":["report"]},{"url":"https://bugzilla.suse.com/1266700","tags":["report"]},{"url":"https://bugzilla.suse.com/1266717","tags":["report"]},{"url":"https://bugzilla.suse.com/1266718","tags":["report"]},{"url":"https://bugzilla.suse.com/1266722","tags":["report"]},{"url":"https://bugzilla.suse.com/1266726","tags":["report"]},{"url":"https://bugzilla.suse.com/1266734","tags":["report"]},{"url":"https://bugzilla.suse.com/1266740","tags":["report"]},{"url":"https://bugzilla.suse.com/1266750","tags":["report"]},{"url":"https://bugzilla.suse.com/1266754","tags":["report"]},{"url":"https://bugzilla.suse.com/1266761","tags":["report"]},{"url":"https://bugzilla.suse.com/1266773","tags":["report"]},{"url":"https://bugzilla.suse.com/1266805","tags":["report"]},{"url":"https://bugzilla.suse.com/1266830","tags":["report"]},{"url":"https://bugzilla.suse.com/1266838","tags":["report"]},{"url":"https://bugzilla.suse.com/1266840","tags":["report"]},{"url":"https://bugzilla.suse.com/1266847","tags":["report"]},{"url":"https://bugzilla.suse.com/1266883","tags":["report"]},{"url":"https://bugzilla.suse.com/1266892","tags":["report"]},{"url":"https://bugzilla.suse.com/1266893","tags":["report"]},{"url":"https://bugzilla.suse.com/1266899","tags":["report"]},{"url":"https://bugzilla.suse.com/1266925","tags":["report"]},{"url":"https://bugzilla.suse.com/1266929","tags":["report"]},{"url":"https://bugzilla.suse.com/1267228","tags":["report"]},{"url":"https://bugzilla.suse.com/1267238","tags":["report"]},{"url":"https://bugzilla.suse.com/1267251","tags":["report"]},{"url":"https://bugzilla.suse.com/1267360","tags":["report"]},{"url":"https://bugzilla.suse.com/1267365","tags":["report"]},{"url":"https://bugzilla.suse.com/1267369","tags":["report"]},{"url":"https://bugzilla.suse.com/1267419","tags":["report"]},{"url":"https://bugzilla.suse.com/1267427","tags":["report"]},{"url":"https://bugzilla.suse.com/1267437","tags":["report"]},{"url":"https://bugzilla.suse.com/1267458","tags":["report"]},{"url":"https://bugzilla.suse.com/1267493","tags":["report"]},{"url":"https://bugzilla.suse.com/1267505","tags":["report"]},{"url":"https://bugzilla.suse.com/1267548","tags":["report"]},{"url":"https://bugzilla.suse.com/1267582","tags":["report"]},{"url":"https://bugzilla.suse.com/1267591","tags":["report"]},{"url":"https://bugzilla.suse.com/1267600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267618","tags":["report"]},{"url":"https://bugzilla.suse.com/1267635","tags":["report"]},{"url":"https://bugzilla.suse.com/1267637","tags":["report"]},{"url":"https://bugzilla.suse.com/1267684","tags":["report"]},{"url":"https://bugzilla.suse.com/1267717","tags":["report"]},{"url":"https://bugzilla.suse.com/1267722","tags":["report"]},{"url":"https://bugzilla.suse.com/1267816","tags":["report"]},{"url":"https://bugzilla.suse.com/1267824","tags":["report"]},{"url":"https://bugzilla.suse.com/1267825","tags":["report"]},{"url":"https://bugzilla.suse.com/1267937","tags":["report"]},{"url":"https://bugzilla.suse.com/1267966","tags":["report"]},{"url":"https://bugzilla.suse.com/1267992","tags":["report"]},{"url":"https://bugzilla.suse.com/1267993","tags":["report"]},{"url":"https://bugzilla.suse.com/1267994","tags":["report"]},{"url":"https://bugzilla.suse.com/1268022","tags":["report"]},{"url":"https://bugzilla.suse.com/1268037","tags":["report"]},{"url":"https://bugzilla.suse.com/1268237","tags":["report"]},{"url":"https://bugzilla.suse.com/1268238","tags":["report"]},{"url":"https://bugzilla.suse.com/1268276","tags":["report"]},{"url":"https://bugzilla.suse.com/1268335","tags":["report"]},{"url":"https://bugzilla.suse.com/1268428","tags":["report"]},{"url":"https://bugzilla.suse.com/1268660","tags":["report"]},{"url":"https://bugzilla.suse.com/1268661","tags":["report"]},{"url":"https://bugzilla.suse.com/1268989","tags":["report"]},{"url":"https://bugzilla.suse.com/1269022","tags":["report"]},{"url":"https://bugzilla.suse.com/1269031","tags":["report"]},{"url":"https://bugzilla.suse.com/1269033","tags":["report"]},{"url":"https://bugzilla.suse.com/1269036","tags":["report"]},{"url":"https://bugzilla.suse.com/1269087","tags":["report"]},{"url":"https://bugzilla.suse.com/1269103","tags":["report"]},{"url":"https://bugzilla.suse.com/1269135","tags":["report"]},{"url":"https://bugzilla.suse.com/1269136","tags":["report"]},{"url":"https://bugzilla.suse.com/1269137","tags":["report"]},{"url":"https://bugzilla.suse.com/1269151","tags":["report"]},{"url":"https://bugzilla.suse.com/1269159","tags":["report"]},{"url":"https://bugzilla.suse.com/1269164","tags":["report"]},{"url":"https://bugzilla.suse.com/1269188","tags":["report"]},{"url":"https://bugzilla.suse.com/1269193","tags":["report"]},{"url":"https://bugzilla.suse.com/1269199","tags":["report"]},{"url":"https://bugzilla.suse.com/1269230","tags":["report"]},{"url":"https://bugzilla.suse.com/1269234","tags":["report"]},{"url":"https://bugzilla.suse.com/1269252","tags":["report"]},{"url":"https://bugzilla.suse.com/1269262","tags":["report"]},{"url":"https://bugzilla.suse.com/1269288","tags":["report"]},{"url":"https://bugzilla.suse.com/1269310","tags":["report"]},{"url":"https://bugzilla.suse.com/1269389","tags":["report"]},{"url":"https://bugzilla.suse.com/1269392","tags":["report"]},{"url":"https://bugzilla.suse.com/1269397","tags":["report"]},{"url":"https://bugzilla.suse.com/1269398","tags":["report"]},{"url":"https://bugzilla.suse.com/1269416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269418","tags":["report"]},{"url":"https://bugzilla.suse.com/1269493","tags":["report"]},{"url":"https://bugzilla.suse.com/1269506","tags":["report"]},{"url":"https://bugzilla.suse.com/1269519","tags":["report"]},{"url":"https://bugzilla.suse.com/1269527","tags":["report"]},{"url":"https://bugzilla.suse.com/1269531","tags":["report"]},{"url":"https://bugzilla.suse.com/1269532","tags":["report"]},{"url":"https://bugzilla.suse.com/1269537","tags":["report"]},{"url":"https://bugzilla.suse.com/1269587","tags":["report"]},{"url":"https://bugzilla.suse.com/1269617","tags":["report"]},{"url":"https://bugzilla.suse.com/1269645","tags":["report"]},{"url":"https://bugzilla.suse.com/1269646","tags":["report"]},{"url":"https://bugzilla.suse.com/1269647","tags":["report"]},{"url":"https://bugzilla.suse.com/1269651","tags":["report"]},{"url":"https://bugzilla.suse.com/1269680","tags":["report"]},{"url":"https://bugzilla.suse.com/1269690","tags":["report"]},{"url":"https://bugzilla.suse.com/1269691","tags":["report"]},{"url":"https://bugzilla.suse.com/1269700","tags":["report"]},{"url":"https://bugzilla.suse.com/1269708","tags":["report"]},{"url":"https://bugzilla.suse.com/1269710","tags":["report"]},{"url":"https://bugzilla.suse.com/1269768","tags":["report"]},{"url":"https://bugzilla.suse.com/1269795","tags":["report"]},{"url":"https://bugzilla.suse.com/1269798","tags":["report"]},{"url":"https://bugzilla.suse.com/1269809","tags":["report"]},{"url":"https://bugzilla.suse.com/1269814","tags":["report"]},{"url":"https://bugzilla.suse.com/1269821","tags":["report"]},{"url":"https://bugzilla.suse.com/1269904","tags":["report"]},{"url":"https://bugzilla.suse.com/1269982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269989","tags":["report"]},{"url":"https://bugzilla.suse.com/1269992","tags":["report"]},{"url":"https://bugzilla.suse.com/1270000","tags":["report"]},{"url":"https://bugzilla.suse.com/1270022","tags":["report"]},{"url":"https://bugzilla.suse.com/1270042","tags":["report"]},{"url":"https://bugzilla.suse.com/1270059","tags":["report"]},{"url":"https://bugzilla.suse.com/1270226","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53362","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622769-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622812-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622835-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260548","tags":["report"]},{"url":"https://bugzilla.suse.com/1261591","tags":["report"]},{"url":"https://bugzilla.suse.com/1263122","tags":["report"]},{"url":"https://bugzilla.suse.com/1264014","tags":["report"]},{"url":"https://bugzilla.suse.com/1264040","tags":["report"]},{"url":"https://bugzilla.suse.com/1264415","tags":["report"]},{"url":"https://bugzilla.suse.com/1264835","tags":["report"]},{"url":"https://bugzilla.suse.com/1265925","tags":["report"]},{"url":"https://bugzilla.suse.com/1266036","tags":["report"]},{"url":"https://bugzilla.suse.com/1266888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262591-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43470","tags":["report"]},{"url":"https://git.kernel.org/linus/410666a298c34ebd57256fde6b24c96bd23059a2","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43470","title":"nfs: return EISDIR on nfs3_proc_create if d_alias is a dir","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","status":"published","published":"2026-05-08T14:22:30.218Z","modified":"2026-05-11T22:25:13.82Z","updated_at":"2026-11-02T13:37:36.275898Z"}],"euvd":[{"id":"EUVD-2026-28776","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","status":"published","published":"2026-05-08T14:22:30Z","modified":"2026-05-11T22:25:13Z","updated_at":"2026-11-02T19:04:42.729611Z"}],"ghsa":[{"id":"GHSA-jprv-4f6g-4wvm","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","status":"published","published":"2026-05-08T15:31:29Z","modified":"2026-05-21T15:34:03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:08:15.106873Z"}],"nvd":[{"id":"CVE-2026-43470","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","status":"published","published":"2026-05-08T15:17:00.09Z","modified":"2026-06-17T10:49:39.827Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"BELL-CVE-2026-43470","status":"published","published":"2026-05-09T06:09:34.472591Z","modified":"2026-06-25T07:18:41.584917863Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.12174Z"},{"id":"DEBIAN-CVE-2026-43470","description":"In the Linux kernel, the following vulnerability has been resolved:  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir  If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative.  This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open.  This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection).  While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.","status":"published","published":"2026-05-08T15:17:00.09Z","modified":"2026-10-01T03:03:13.532335726Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-2418","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL.  So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: \u0026lt;TASK\u0026gt; kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f[akpm@linux-foundation.org: add unlikely()](CVE-2024-56611)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/MSI: Handle lack of irqdomain gracefully\n\nAlexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a\nRISCV platform which does not provide PCI/MSI support:\n\n WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32\n __pci_enable_msix_range+0x30c/0x596\n pci_msi_setup_msi_irqs+0x2c/0x32\n pci_alloc_irq_vectors_affinity+0xb8/0xe2\n\nRISCV uses hierarchical interrupt domains and correctly does not implement\nthe legacy fallback. The warning triggers from the legacy fallback stub.\n\nThat warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent\ndomain is associated with the device or not. There is a check for MSI-X,\nwhich has a legacy assumption. But that legacy fallback assumption is only\nvalid when legacy support is enabled, but otherwise the check should simply\nreturn -ENOTSUPP.\n\nLoongarch tripped over the same problem and blindly enabled legacy support\nwithout implementing the legacy fallbacks. There are weak implementations\nwhich return an error, so the problem was papered over.\n\nCorrect pci_msi_domain_supports() to evaluate the legacy mode and add\nthe missing supported check into the MSI enable path to complete it.(CVE-2024-56760)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix nfs_release_folio() to not deadlock via kcompactd writeback\n\nAdd PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so\nnfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.\n\nOtherwise NFS can deadlock waiting for kcompactd enduced writeback which\nrecurses back to NFS (which triggers writeback to NFSD via NFS loopback\nmount on the same host, NFSD blocks waiting for XFS\u0026apos;s call to\n__filemap_get_folio):\n\n6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.\n\n{---\n[58] \u0026quot;kcompactd0\u0026quot;\n[\u0026lt;0\u0026gt;] folio_wait_bit+0xe8/0x200\n[\u0026lt;0\u0026gt;] folio_wait_writeback+0x2b/0x80\n[\u0026lt;0\u0026gt;] nfs_wb_folio+0x80/0x1b0 [nfs]\n[\u0026lt;0\u0026gt;] nfs_release_folio+0x68/0x130 [nfs]\n[\u0026lt;0\u0026gt;] split_huge_page_to_list_to_order+0x362/0x840\n[\u0026lt;0\u0026gt;] migrate_pages_batch+0x43d/0xb90\n[\u0026lt;0\u0026gt;] migrate_pages_sync+0x9a/0x240\n[\u0026lt;0\u0026gt;] migrate_pages+0x93c/0x9f0\n[\u0026lt;0\u0026gt;] compact_zone+0x8e2/0x1030\n[\u0026lt;0\u0026gt;] compact_node+0xdb/0x120\n[\u0026lt;0\u0026gt;] kcompactd+0x121/0x2e0\n[\u0026lt;0\u0026gt;] kthread+0xcf/0x100\n[\u0026lt;0\u0026gt;] ret_from_fork+0x31/0x40\n[\u0026lt;0\u0026gt;] ret_from_fork_asm+0x1a/0x30\n---}\n\n[(CVE-2025-21908)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio\n\nCommit b15c87263a69 (\u0026quot;hwpoison, memory_hotplug: allow hwpoisoned pages to\nbe offlined) add page poison checks in do_migrate_range in order to make\noffline hwpoisoned page possible by introducing isolate_lru_page and\ntry_to_unmap for hwpoisoned page.  However folio lock must be held before\ncalling try_to_unmap.  Add it to fix this problem.\n\nWarning will be produced if folio is not locked during unmap:\n\n  ------------[ cut here ]------------\n  kernel BUG at ./include/linux/swapops.h:400!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41\n  Tainted: [W]=WARN\n  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : try_to_unmap_one+0xb08/0xd3c\n  lr : try_to_unmap_one+0x3dc/0xd3c\n  Call trace:\n   try_to_unmap_one+0xb08/0xd3c (P)\n   try_to_unmap_one+0x3dc/0xd3c (L)\n   rmap_walk_anon+0xdc/0x1f8\n   rmap_walk+0x3c/0x58\n   try_to_unmap+0x88/0x90\n   unmap_poisoned_folio+0x30/0xa8\n   do_migrate_range+0x4a0/0x568\n   offline_pages+0x5a4/0x670\n   memory_block_action+0x17c/0x374\n   memory_subsys_offline+0x3c/0x78\n   device_offline+0xa4/0xd0\n   state_store+0x8c/0xf0\n   dev_attr_store+0x18/0x2c\n   sysfs_kf_write+0x44/0x54\n   kernfs_fop_write_iter+0x118/0x1a8\n   vfs_write+0x3a8/0x4bc\n   ksys_write+0x6c/0xf8\n   __arm64_sys_write+0x1c/0x28\n   invoke_syscall+0x44/0x100\n   el0_svc_common.constprop.0+0x40/0xe0\n   do_el0_svc+0x1c/0x28\n   el0_svc+0x30/0xd0\n   el0t_64_sync_handler+0xc8/0xcc\n   el0t_64_sync+0x198/0x19c\n  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)\n  ---[ end trace 0000000000000000 ]---(CVE-2025-21931)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Bridge, fix the crash caused by LAG state check\n\nWhen removing LAG device from bridge, NETDEV_CHANGEUPPER event is\ntriggered. Driver finds the lower devices (PFs) to flush all the\noffloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns\nfalse if one of PF is unloaded. In such case,\nmlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of\nthe alive PF, and the flush is skipped.\n\nBesides, the bridge fdb entry\u0026apos;s lastuse is updated in mlx5 bridge\nevent handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be\nignored in this case because the upper interface for bond is deleted,\nand the entry will never be aged because lastuse is never updated.\n\nTo make things worse, as the entry is alive, mlx5 bridge workqueue\nkeeps sending that event, which is then handled by kernel bridge\nnotifier. It causes the following crash when accessing the passed bond\nnetdev which is already destroyed.\n\nTo fix this issue, remove such checks. LAG state is already checked in\ncommit 15f8f168952f (\u0026quot;net/mlx5: Bridge, verify LAG state when adding\nbond to bridge\u0026quot;), driver still need to skip offload if LAG becomes\ninvalid state after initialization.\n\n Oops: stack segment: 0000 [#1] SMP\n CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G           OE      6.11.0_mlnx #1\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core]\n RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge]\n Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 \u0026lt;4c\u0026gt; 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7\n RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297\n RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff\n RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0\n RBP: 6669746f6e690a30 R08: 0000000000000000 R09: ffff888123ae92c8\n R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60\n R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f15914c8734 CR3: 0000000002830005 CR4: 0000000000770ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die_body+0x1a/0x60\n  ? die+0x38/0x60\n  ? do_trap+0x10b/0x120\n  ? do_error_trap+0x64/0xa0\n  ? exc_stack_segment+0x33/0x50\n  ? asm_exc_stack_segment+0x22/0x30\n  ? br_switchdev_event+0x2c/0x110 [bridge]\n  ? sched_balance_newidle.isra.149+0x248/0x390\n  notifier_call_chain+0x4b/0xa0\n  atomic_notifier_call_chain+0x16/0x20\n  mlx5_esw_bridge_update+0xec/0x170 [mlx5_core]\n  mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core]\n  process_scheduled_works+0x81/0x390\n  worker_thread+0x106/0x250\n  ? bh_worker+0x110/0x110\n  kthread+0xb7/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;(CVE-2025-21970)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.(CVE-2025-21971)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched: address a potential NULL pointer dereference in the GRED scheduler.\n\nIf kzalloc in gred_init returns a NULL pointer, the code follows the\nerror handling path, invoking gred_destroy. This, in turn, calls\ngred_offload, where memset could receive a NULL pointer as input,\npotentially leading to a kernel crash.\n\nWhen table-\u0026gt;opt is NULL in gred_init(), gred_change_table_def()\nis not called yet, so it is not necessary to call -\u0026gt;ndo_setup_tc()\nin gred_offload().(CVE-2025-21980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memory leak in aRFS after reset\n\nFix aRFS (accelerated Receive Flow Steering) structures memory leak by\nadding a checker to verify if aRFS memory is already allocated while\nconfiguring VSI. aRFS objects are allocated in two cases:\n- as part of VSI initialization (at probe), and\n- as part of reset handling\n\nHowever, VSI reconfiguration executed during reset involves memory\nallocation one more time, without prior releasing already allocated\nresources. This led to the memory leak with the following signature:\n\n[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak\nunreferenced object 0xff3c1ca7252e6000 (size 8192):\n  comm \u0026quot;kworker/0:0\u0026quot;, pid 8, jiffies 4296833052\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 0):\n    [\u0026lt;ffffffff991ec485\u0026gt;] __kmalloc_cache_noprof+0x275/0x340\n    [\u0026lt;ffffffffc0a6e06a\u0026gt;] ice_init_arfs+0x3a/0xe0 [ice]\n    [\u0026lt;ffffffffc09f1027\u0026gt;] ice_vsi_cfg_def+0x607/0x850 [ice]\n    [\u0026lt;ffffffffc09f244b\u0026gt;] ice_vsi_setup+0x5b/0x130 [ice]\n    [\u0026lt;ffffffffc09c2131\u0026gt;] ice_init+0x1c1/0x460 [ice]\n    [\u0026lt;ffffffffc09c64af\u0026gt;] ice_probe+0x2af/0x520 [ice]\n    [\u0026lt;ffffffff994fbcd3\u0026gt;] local_pci_probe+0x43/0xa0\n    [\u0026lt;ffffffff98f07103\u0026gt;] work_for_cpu_fn+0x13/0x20\n    [\u0026lt;ffffffff98f0b6d9\u0026gt;] process_one_work+0x179/0x390\n    [\u0026lt;ffffffff98f0c1e9\u0026gt;] worker_thread+0x239/0x340\n    [\u0026lt;ffffffff98f14abc\u0026gt;] kthread+0xcc/0x100\n    [\u0026lt;ffffffff98e45a6d\u0026gt;] ret_from_fork+0x2d/0x50\n    [\u0026lt;ffffffff98e083ba\u0026gt;] ret_from_fork_asm+0x1a/0x30\n    ...(CVE-2025-21981)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: switchdev: Convert blocking notification chain to a raw one\n\nA blocking notification chain uses a read-write semaphore to protect the\nintegrity of the chain. The semaphore is acquired for writing when\nadding / removing notifiers to / from the chain and acquired for reading\nwhen traversing the chain and informing notifiers about an event.\n\nIn case of the blocking switchdev notification chain, recursive\nnotifications are possible which leads to the semaphore being acquired\ntwice for reading and to lockdep warnings being generated [1].\n\nSpecifically, this can happen when the bridge driver processes a\nSWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications\nabout deferred events when calling switchdev_deferred_process().\n\nFix this by converting the notification chain to a raw notification\nchain in a similar fashion to the netdev notification chain. Protect\nthe chain using the RTNL mutex by acquiring it when modifying the chain.\nEvents are always informed under the RTNL mutex, but add an assertion in\ncall_switchdev_blocking_notifiers() to make sure this is not violated in\nthe future.\n\nMaintain the \u0026quot;blocking\u0026quot; prefix as events are always emitted from process\ncontext and listeners are allowed to block.\n\n[1]:\nWARNING: possible recursive locking detected\n6.14.0-rc4-custom-g079270089484 #1 Not tainted\n--------------------------------------------\nip/52731 is trying to acquire lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nbut task is already holding lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\nCPU0\n----\nlock((switchdev_blocking_notif_chain).rwsem);\nlock((switchdev_blocking_notif_chain).rwsem);\n\n*** DEADLOCK ***\nMay be due to missing lock nesting notation\n3 locks held by ip/52731:\n #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0\n #1: ffffffff8731f628 (\u0026amp;net-\u0026gt;rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0\n #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nstack backtrace:\n...\n? __pfx_down_read+0x10/0x10\n? __pfx_mark_lock+0x10/0x10\n? __pfx_switchdev_port_attr_set_deferred+0x10/0x10\nblocking_notifier_call_chain+0x58/0xa0\nswitchdev_port_attr_notify.constprop.0+0xb3/0x1b0\n? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10\n? mark_held_locks+0x94/0xe0\n? switchdev_deferred_process+0x11a/0x340\nswitchdev_port_attr_set_deferred+0x27/0xd0\nswitchdev_deferred_process+0x164/0x340\nbr_switchdev_port_unoffload+0xc8/0x100 [bridge]\nbr_switchdev_blocking_event+0x29f/0x580 [bridge]\nnotifier_call_chain+0xa2/0x440\nblocking_notifier_call_chain+0x6e/0xa0\nswitchdev_bridge_port_unoffload+0xde/0x1a0\n...(CVE-2025-21986)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix fence reference count leak\n\nThe last_scheduled fence leaks when an entity is being killed and adding\nthe cleanup callback fails.\n\nDecrement the reference count of prev when dma_fence_add_callback()\nfails, ensuring proper balance.\n\n[phasta: add git tag info for stable kernel](CVE-2025-21995)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix integer overflow in qaic_validate_req()\n\nThese are u64 variables that come from the user via\nqaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that\nthe math doesn\u0026apos;t have an integer wrapping bug.(CVE-2025-22001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: dummy: force synchronous probing\n\nSometimes I get a NULL pointer dereference at boot time in kobject_get()\nwith the following call stack:\n\nanatop_regulator_probe()\n devm_regulator_register()\n  regulator_register()\n   regulator_resolve_supply()\n    kobject_get()\n\nBy placing some extra BUG_ON() statements I could verify that this is\nraised because probing of the \u0026apos;dummy\u0026apos; regulator driver is not completed\n(\u0026apos;dummy_regulator_rdev\u0026apos; is still NULL).\n\nIn the JTAG debugger I can see that dummy_regulator_probe() and\nanatop_regulator_probe() can be run by different kernel threads\n(kworker/u4:*).  I haven\u0026apos;t further investigated whether this can be\nchanged or if there are other possibilities to force synchronization\nbetween these two probe routines.  On the other hand I don\u0026apos;t expect much\nboot time penalty by probing the \u0026apos;dummy\u0026apos; regulator synchronously.(CVE-2025-22009)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak in spufs_create_context()\n\nLeak fixes back in 2008 missed one case - if we are trying to set affinity\nand spufs_mkdir() fails, we need to drop the reference to neighbor.(CVE-2025-22071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;smb: client: fix TCP timers deadlock after rmmod\u0026quot;\n\nThis reverts commit e9f2517a3e18a54a3943c098d2226b245d488801.\n\nCommit e9f2517a3e18 (\u0026quot;smb: client: fix TCP timers deadlock after\nrmmod\u0026quot;) is intended to fix a null-ptr-deref in LOCKDEP, which is\nmentioned as CVE-2024-54680, but is actually did not fix anything;\nThe issue can be reproduced on top of it. [0]\n\nAlso, it reverted the change by commit ef7134c7fc48 (\u0026quot;smb: client:\nFix use-after-free of network namespace.\u0026quot;) and introduced a real\nissue by reviving the kernel TCP socket.\n\nWhen a reconnect happens for a CIFS connection, the socket state\ntransitions to FIN_WAIT_1.  Then, inet_csk_clear_xmit_timers_sync()\nin tcp_close() stops all timers for the socket.\n\nIf an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1\nforever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans.\n\nUsually, FIN can be retransmitted by the peer, but if the peer aborts\nthe connection, the issue comes into reality.\n\nI warned about this privately by pointing out the exact report [1],\nbut the bogus fix was finally merged.\n\nSo, we should not stop the timers to finally kill the connection on\nour side in that case, meaning we must not use a kernel socket for\nTCP whose sk-\u0026gt;sk_net_refcnt is 0.\n\nThe kernel socket does not have a reference to its netns to make it\npossible to tear down netns without cleaning up every resource in it.\n\nFor example, tunnel devices use a UDP socket internally, but we can\ndestroy netns without removing such devices and let it complete\nduring exit.  Otherwise, netns would be leaked when the last application\ndied.\n\nHowever, this is problematic for TCP sockets because TCP has timers to\nclose the connection gracefully even after the socket is close()d.  The\nlifetime of the socket and its netns is different from the lifetime of\nthe underlying connection.\n\nIf the socket user does not maintain the netns lifetime, the timer could\nbe fired after the socket is close()d and its netns is freed up, resulting\nin use-after-free.\n\nActually, we have seen so many similar issues and converted such sockets\nto have a reference to netns.\n\nThat\u0026apos;s why I converted the CIFS client socket to have a reference to\nnetns (sk-\u0026gt;sk_net_refcnt == 1), which is somehow mentioned as out-of-scope\nof CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right\nfix**.\n\nRegarding the LOCKDEP issue, we can prevent the module unload by\nbumping the module refcount when switching the LOCKDDEP key in\nsock_lock_init_class_and_name(). [2]\n\nFor a while, let\u0026apos;s revert the bogus fix.\n\nNote that now we can use sk_net_refcnt_upgrade() for the socket\nconversion, but I\u0026apos;ll do so later separately to make backport easy.(CVE-2025-22077)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: fix pipe accounting mismatch\n\nCurrently, watch_queue_set_size() modifies the pipe buffers charged to\nuser-\u0026gt;pipe_bufs without updating the pipe-\u0026gt;nr_accounted on the pipe\nitself, due to the if (!pipe_has_watch_queue()) test in\npipe_resize_ring(). This means that when the pipe is ultimately freed,\nwe decrement user-\u0026gt;pipe_bufs by something other than what than we had\ncharged to it, potentially leading to an underflow. This in turn can\ncause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.\n\nTo remedy this, explicitly account for the pipe usage in\nwatch_queue_set_size() to match the number set via account_pipe_buffers()\n\n(It\u0026apos;s unclear why watch_queue_set_size() does not update nr_accounted;\nit may be due to intentional overprovisioning in watch_queue_set_size()?)(CVE-2025-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.(CVE-2025-23157)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: add sanity check for agwidth in dbMount\n\nThe width in dmapctl of the AG is zero, it trigger a divide error when\ncalculating the control page level in dbAllocAG.\n\nTo avoid this issue, add a check for agwidth in dbAllocAG.(CVE-2025-37740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group\n\nCurrently, mtk_iommu calls during probe iommu_device_register before\nthe hw_list from driver data is initialized. Since iommu probing issue\nfix, it leads to NULL pointer dereference in mtk_iommu_device_group when\nhw_list is accessed with list_first_entry (not null safe).\n\nSo, change the call order to ensure iommu_device_register is called\nafter the driver data are initialized.(CVE-2025-37748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37766)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix dangling pointer in krb_authenticate\n\nkrb_authenticate frees sess-\u0026gt;user and does not set the pointer\nto NULL. It calls ksmbd_krb5_authenticate to reinitialise\nsess-\u0026gt;user but that function may return without doing so. If\nthat happens then smb2_sess_setup, which calls krb_authenticate,\nwill be accessing free\u0026apos;d memory when it later uses sess-\u0026gt;user.(CVE-2025-37778)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\navs_component_probe() does not check for this case, which results in a\nNULL pointer dereference.(CVE-2025-37793)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we\u0026apos;re hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()-\u0026gt;virtsnd_build_devs()-\u0026gt;virtsnd_pcm_parse_cfg()\n\nWe set snd-\u0026gt;nsubstreams, allocate the snd-\u0026gt;substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!(CVE-2025-37805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration\n\nResolve kernel panic while accessing IRQ handler associated with the\ngenerated IRQ. This is done by acquiring the spinlock and storing the\ncurrent interrupt state before handling the interrupt request using\ngeneric_handle_irq.\n\nA previous fix patch was submitted where \u0026apos;generic_handle_irq\u0026apos; was\nreplaced with \u0026apos;handle_nested_irq\u0026apos;. However, this change also causes\nthe kernel panic where after determining which GPIO triggered the\ninterrupt and attempting to call handle_nested_irq with the mapped\nIRQ number, leads to a failure in locating the registered handler.(CVE-2025-37815)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy-\u0026gt;cpus mask. apple_soc_cpufreq_get_rate() does not check\nfor this case, which results in a NULL pointer dereference.(CVE-2025-37831)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: avoid NULL pointer dereference in dbg call\n\ncifs_server_dbg() implies server to be non-NULL so\nmove call under condition to avoid NULL pointer dereference.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37844)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: debugfs hang_hws skip GPU with MES\n\ndebugfs hang_hws is used by GPU reset test with HWS, for MES this crash\nthe kernel with NULL pointer access because dqm-\u0026gt;packet_mgr is not setup\nfor MES path.\n\nSkip GPU with MES for now, MES hang_hws debugfs interface will be\nsupported later.(CVE-2025-37853)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()\n\nThe variable d-\u0026gt;name, returned by devm_kasprintf(), could be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\u0026quot;ice: Fix some null pointer dereference issues in ice_ptp.c\u0026quot;).\n\nThis issue is found by our static analysis tool(CVE-2025-37881)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Consistently treat platform_max as control value\n\nThis reverts commit 9bdd10d57a88 (\u0026quot;ASoC: ops: Shift tested values in\nsnd_soc_put_volsw() by +min\u0026quot;), and makes some additional related\nupdates.\n\nThere are two ways the platform_max could be interpreted; the maximum\nregister value, or the maximum value the control can be set to. The\npatch moved from treating the value as a control value to a register\none. When the patch was applied it was technically correct as\nsnd_soc_limit_volume() also used the register interpretation. However,\neven then most of the other usages treated platform_max as a\ncontrol value, and snd_soc_limit_volume() has since been updated to\nalso do so in commit fb9ad24485087 (\u0026quot;ASoC: ops: add correct range\ncheck for limiting volume\u0026quot;). That patch however, missed updating\nsnd_soc_put_volsw() back to the control interpretation, and fixing\nsnd_soc_info_volsw_range(). The control interpretation makes more\nsense as limiting is typically done from the machine driver, so it is\nappropriate to use the customer facing representation rather than the\ninternal codec representation. Update all the code to consistently use\nthis interpretation of platform_max.\n\nFinally, also add some comments to the soc_mixer_control struct to\nhopefully avoid further patches switching between the two approaches.(CVE-2025-37889)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Balance device refcount when destroying devices\n\nUsing device_find_child() to lookup the proper SCMI device to destroy\ncauses an unbalance in device refcount, since device_find_child() calls an\nimplicit get_device(): this, in turns, inhibits the call of the provided\nrelease methods upon devices destruction.\n\nAs a consequence, one of the structures that is not freed properly upon\ndestruction is the internal struct device_private dev-\u0026gt;p populated by the\ndrivers subsystem core.\n\nKMemleak detects this situation since loading/unloding some SCMI driver\ncauses related devices to be created/destroyed without calling any\ndevice_release method.\n\nunreferenced object 0xffff00000f583800 (size 512):\n  comm \u0026quot;insmod\u0026quot;, pid 227, jiffies 4294912190\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff  ........`6......\n  backtrace (crc 114e2eed):\n    kmemleak_alloc+0xbc/0xd8\n    __kmalloc_cache_noprof+0x2dc/0x398\n    device_add+0x954/0x12d0\n    device_register+0x28/0x40\n    __scmi_device_create.part.0+0x1bc/0x380\n    scmi_device_create+0x2d0/0x390\n    scmi_create_protocol_devices+0x74/0xf8\n    scmi_device_request_notifier+0x1f8/0x2a8\n    notifier_call_chain+0x110/0x3b0\n    blocking_notifier_call_chain+0x70/0xb0\n    scmi_driver_register+0x350/0x7f0\n    0xffff80000a3b3038\n    do_one_initcall+0x12c/0x730\n    do_init_module+0x1dc/0x640\n    load_module+0x4b20/0x5b70\n    init_module_from_file+0xec/0x158\n\n$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0\ndevice_add+0x954/0x12d0:\nkmalloc_noprof at include/linux/slab.h:901\n(inlined by) kzalloc_noprof at include/linux/slab.h:1037\n(inlined by) device_private_init at drivers/base/core.c:3510\n(inlined by) device_add at drivers/base/core.c:3561\n\nBalance device refcount by issuing a put_device() on devices found via\ndevice_find_child().(CVE-2025-37905)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()\n\nA NULL pointer dereference can occur in skb_dequeue() when processing a\nQCA firmware crash dump on WCN7851 (0489:e0f3).\n\n[ 93.672166] Bluetooth: hci0: ACL memdump size(589824)\n\n[ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth]\n[ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80\n\nThe issue stems from handle_dump_pkt_qca() returning 0 even when a dump\npacket is successfully processed. This is because it incorrectly\nforwards the return value of hci_devcd_init() (which returns 0 on\nsuccess). As a result, the caller (btusb_recv_acl_qca() or\nbtusb_recv_evt_qca()) assumes the packet was not handled and passes it\nto hci_recv_frame(), leading to premature kfree() of the skb.\n\nLater, hci_devcd_rx() attempts to dequeue the same skb from the dump\nqueue, resulting in a NULL pointer dereference.\n\nFix this by:\n1. Making handle_dump_pkt_qca() return 0 on success and negative errno\n   on failure, consistent with kernel conventions.\n2. Splitting dump packet detection into separate functions for ACL\n   and event packets for better structure and readability.\n\nThis ensures dump packets are properly identified and consumed, avoiding\ndouble handling and preventing NULL pointer access.(CVE-2025-37918)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent out-of-bounds stream writes by validating *pos\n\nksmbd_vfs_stream_write() did not validate whether the write offset\n(*pos) was within the bounds of the existing stream data length (v_len).\nIf *pos was greater than or equal to v_len, this could lead to an\nout-of-bounds memory write.\n\nThis patch adds a check to ensure *pos is less than v_len before\nproceeding. If the condition fails, -EINVAL is returned.(CVE-2025-37947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix deadlock\n\nThis patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock\nfunctions to the UCSI driver. ucsi_con_mutex_lock ensures the connector\nmutex is only locked if a connection is established and the partner pointer\nis valid. This resolves a deadlock scenario where\nucsi_displayport_remove_partner holds con-\u0026gt;mutex waiting for\ndp_altmode_work to complete while dp_altmode_work attempts to acquire it.(CVE-2025-37967)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Refactor remove call with idxd_cleanup() helper\n\nThe idxd_cleanup() helper cleans up perfmon, interrupts, internals and\nso on. Refactor remove call with the idxd_cleanup() helper to avoid code\nduplication. Note, this also fixes the missing put_device() for idxd\ngroups, enginces and wqs.(CVE-2025-38014)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Annotate FDB data races\n\nThe \u0026apos;used\u0026apos; and \u0026apos;updated\u0026apos; fields in the FDB entry structure can be\naccessed concurrently by multiple threads, leading to reports such as\n[1]. Can be reproduced using [2].\n\nSuppress these reports by annotating these accesses using\nREAD_ONCE() / WRITE_ONCE().\n\n[1]\nBUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit\n\nwrite to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:\n vxlan_xmit+0xb29/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:\n vxlan_xmit+0xadf/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000000fffbac6e -\u0026gt; 0x00000000fffbac6f\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n\n[2]\n #!/bin/bash\n\n set +H\n echo whitelist \u0026gt; /sys/kernel/debug/kcsan\n echo !vxlan_xmit \u0026gt; /sys/kernel/debug/kcsan\n\n ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1\n bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1\n taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;\n taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;(CVE-2025-38037)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Set dma_mask for ffa devices\n\nSet dma_mask for FFA devices, otherwise DMA allocation using the device pointer\nlead to following warning:\n\nWARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124(CVE-2025-38043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u0026gt;ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---(CVE-2025-38051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them.(CVE-2025-38064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Fix NULL pointer dereference when nosmp is used\n\nWith nosmp in cmdline, other CPUs are not brought up, leaving\ntheir cpc_desc_ptr NULL. CPU0\u0026apos;s iteration via for_each_possible_cpu()\ndereferences these NULL pointers, causing panic.\n\nPanic backtrace:\n\n[    0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8\n...\n[    0.403255] [\u0026lt;ffffffff809a5818\u0026gt;] cppc_allow_fast_switch+0x6a/0xd4\n...\nKernel panic - not syncing: Attempted to kill init!\n\n[ rjw: New subject ](CVE-2025-38113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: add missing NULL check for gve_alloc_pending_packet() in TX DQO\n\ngve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()\ndid not check for this case before dereferencing the returned pointer.\n\nAdd a missing NULL check to prevent a potential NULL pointer\ndereference when allocation fails.\n\nThis improves robustness in low-memory scenarios.(CVE-2025-38122)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix napi rx poll issue\n\nWhen driver handles the napi rx polling requests, the netdev might\nhave been released by the dellink logic triggered by the disconnect\noperation on user plane. However, in the logic of processing skb in\npolling, an invalid netdev is still being used, which causes a panic.\n\nBUG: kernel NULL pointer dereference, address: 00000000000000f1\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:dev_gro_receive+0x3a/0x620\n[...]\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x4f/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]\n ? dev_gro_receive+0x3a/0x620\n napi_gro_receive+0xad/0x170\n t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]\n t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]\n net_rx_action+0x103/0x470\n irq_exit_rcu+0x13a/0x310\n sysvec_apic_timer_interrupt+0x56/0x90\n \u0026lt;/IRQ\u0026gt;(CVE-2025-38123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: prevent deactivate active config while enabling the config\n\nWhile enable active config via cscfg_csdev_enable_active_config(),\nactive config could be deactivated via configfs\u0026apos; sysfs interface.\nThis could make UAF issue in below scenario:\n\nCPU0                                          CPU1\n(sysfs enable)                                load module\n                                              cscfg_load_config_sets()\n                                              activate config. // sysfs\n                                              (sys_active_cnt == 1)\n...\ncscfg_csdev_enable_active_config()\nlock(csdev-\u0026gt;cscfg_csdev_lock)\n// here load config activate by CPU1\nunlock(csdev-\u0026gt;cscfg_csdev_lock)\n\n                                              deactivate config // sysfs\n                                              (sys_activec_cnt == 0)\n                                              cscfg_unload_config_sets()\n                                              unload module\n\n// access to config_desc which freed\n// while unloading module.\ncscfg_csdev_enable_config\n\nTo address this, use cscfg_config_desc\u0026apos;s active_cnt as a reference count\n which will be holded when\n    - activate the config.\n    - enable the activated config.\nand put the module reference when config_active_cnt == 0.(CVE-2025-38131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: mscc: Fix memory leak when using one step timestamping\n\nFix memory leak when running one-step timestamping. When running\none-step sync timestamping, the HW is configured to insert the TX time\ninto the frame, so there is no reason to keep the skb anymore. As in\nthis case the HW will never generate an interrupt to say that the frame\nwas timestamped, then the frame will never released.\nFix this by freeing the frame in case of one-step timestamping.(CVE-2025-38148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error flow upon firmware failure for RQ destruction\n\nUpon RQ destruction if the firmware command fails which is the\nlast resource to be destroyed some SW resources were already cleaned\nregardless of the failure.\n\nNow properly rollback the object to its original state upon such failure.\n\nIn order to avoid a use-after free in case someone tries to destroy the\nobject again, which results in the following kernel trace:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148\nModules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE)\nCPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G           OE     -------  ---  6.12.0-54.el10.aarch64 #1\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : refcount_warn_saturate+0xf4/0x148\nlr : refcount_warn_saturate+0xf4/0x148\nsp : ffff80008b81b7e0\nx29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001\nx26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00\nx23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000\nx20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006\nx17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f\nx14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78\nx11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90\nx8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff\nx5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600\nCall trace:\n refcount_warn_saturate+0xf4/0x148\n mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib]\n mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib]\n mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib]\n ib_destroy_wq_user+0x30/0xc0 [ib_core]\n uverbs_free_wq+0x28/0x58 [ib_uverbs]\n destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs]\n uverbs_destroy_uobject+0x48/0x240 [ib_uverbs]\n __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs]\n uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs]\n ib_uverbs_close+0x2c/0x100 [ib_uverbs]\n __fput+0xd8/0x2f0\n __fput_sync+0x50/0x70\n __arm64_sys_close+0x40/0x90\n invoke_syscall.constprop.0+0x74/0xd0\n do_el0_svc+0x48/0xe8\n el0_svc+0x44/0x1d0\n el0t_64_sync_handler+0x120/0x130\n el0t_64_sync+0x1a4/0x1a8(CVE-2025-38161)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()\n\nBefore calling lan743x_ptp_io_event_clock_get(), the \u0026apos;channel\u0026apos; value\nis checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).\nThis seems correct and aligns with the PTP interrupt status register\n(PTP_INT_STS) specifications.\n\nHowever, lan743x_ptp_io_event_clock_get() writes to ptp-\u0026gt;extts[] with\nonly LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:\n\n    lan743x_ptp_io_event_clock_get(..., u8 channel,...)\n    {\n        ...\n        /* Update Local timestamp */\n        extts = \u0026amp;ptp-\u0026gt;extts[channel];\n        extts-\u0026gt;ts.tv_sec = sec;\n        ...\n    }\n\nTo avoid an out-of-bounds write and utilize all the supported GPIO\ninputs, set LAN743X_PTP_N_EXTTS to 8.\n\nDetected using the static analysis tool - Svace.(CVE-2025-38183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl-\u0026gt;perturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0(CVE-2025-38193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before writing summary\n\nSyzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault\ninjection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn\u0026apos;t\ncheck return value of jffs2_prealloc_raw_node_refs and simply lets any\nerror propagate into jffs2_sum_write_data, which eventually calls\njffs2_link_node_ref in order to link the summary to an expectedly allocated\nnode.\n\nkernel BUG at fs/jffs2/nodelist.c:592!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592\nCall Trace:\n \u0026lt;TASK\u0026gt;\n jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]\n jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874\n jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388\n jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301\n generic_perform_write+0x314/0x5d0 mm/filemap.c:3856\n __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973\n generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005\n call_write_iter include/linux/fs.h:2265 [inline]\n do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10c/0x170 fs/splice.c:950\n splice_direct_to_actor+0x337/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFix this issue by checking return value of jffs2_prealloc_raw_node_refs\nbefore calling jffs2_sum_write_data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-38194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix softlockup with mTHP swapin\n\nFollowing softlockup can be easily reproduced on my test machine with:\n\necho always \u0026gt; /sys/kernel/mm/transparent_hugepage/hugepages-64kB/enabled\nswapon /dev/zram0 # zram0 is a 48G swap device\nmkdir -p /sys/fs/cgroup/memory/test\necho 1G \u0026gt; /sys/fs/cgroup/test/memory.max\necho $BASHPID \u0026gt; /sys/fs/cgroup/test/cgroup.procs\nwhile true; do\n    dd if=/dev/zero of=/tmp/test.img bs=1M count=5120\n    cat /tmp/test.img \u0026gt; /dev/null\n    rm /tmp/test.img\ndone\n\nThen after a while:\nwatchdog: BUG: soft lockup - CPU#0 stuck for 763s! [cat:5787]\nModules linked in: zram virtiofs\nCPU: 0 UID: 0 PID: 5787 Comm: cat Kdump: loaded Tainted: G             L      6.15.0.orig-gf3021d9246bc-dirty #118 PREEMPT(voluntary)·\nTainted: [L]=SOFTLOCKUP\nHardware name: Red Hat KVM/RHEL-AV, BIOS 0.0.0 02/06/2015\nRIP: 0010:mpol_shared_policy_lookup+0xd/0x70\nCode: e9 b8 b4 ff ff 31 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 41 54 55 53 \u0026lt;48\u0026gt; 8b 1f 48 85 db 74 41 4c 8d 67 08 48 89 fb 48 89 f5 4c 89 e7 e8\nRSP: 0018:ffffc90002b1fc28 EFLAGS: 00000202\nRAX: 00000000001c20ca RBX: 0000000000724e1e RCX: 0000000000000001\nRDX: ffff888118e214c8 RSI: 0000000000057d42 RDI: ffff888118e21518\nRBP: 000000000002bec8 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000bf4 R11: 0000000000000000 R12: 0000000000000001\nR13: 00000000001c20ca R14: 00000000001c20ca R15: 0000000000000000\nFS:  00007f03f995c740(0000) GS:ffff88a07ad9a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f03f98f1000 CR3: 0000000144626004 CR4: 0000000000770eb0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n shmem_alloc_folio+0x31/0xc0\n shmem_swapin_folio+0x309/0xcf0\n ? filemap_get_entry+0x117/0x1e0\n ? xas_load+0xd/0xb0\n ? filemap_get_entry+0x101/0x1e0\n shmem_get_folio_gfp+0x2ed/0x5b0\n shmem_file_read_iter+0x7f/0x2e0\n vfs_read+0x252/0x330\n ksys_read+0x68/0xf0\n do_syscall_64+0x4c/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f03f9a46991\nCode: 00 48 8b 15 81 14 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d 35 97 10 00 00 74 13 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec\nRSP: 002b:00007fff3c52bd28 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007f03f9a46991\nRDX: 0000000000040000 RSI: 00007f03f98ba000 RDI: 0000000000000003\nRBP: 00007fff3c52bd50 R08: 0000000000000000 R09: 00007f03f9b9a380\nR10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000\nR13: 00007f03f98ba000 R14: 0000000000000003 R15: 0000000000000000\n \u0026lt;/TASK\u0026gt;\n\nThe reason is simple, readahead brought some order 0 folio in swap cache,\nand the swapin mTHP folio being allocated is in conflict with it, so\nswapcache_prepare fails and causes shmem_swap_alloc_folio to return\n-EEXIST, and shmem simply retries again and again causing this loop.\n\nFix it by applying a similar fix for anon mTHP swapin.\n\nThe performance change is very slight, time of swapin 10g zero folios\nwith shmem (test for 12 times):\nBefore:  2.47s\nAfter:   2.48s\n\n[(CVE-2025-38241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()\n\nWhile testing null_blk with configfs, echo 0 \u0026gt; poll_queues will trigger\nfollowing panic:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\nRIP: 0010:__bitmap_or+0x48/0x70\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __group_cpus_evenly+0x822/0x8c0\n group_cpus_evenly+0x2d9/0x490\n blk_mq_map_queues+0x1e/0x110\n null_map_queues+0xc9/0x170 [null_blk]\n blk_mq_update_queue_map+0xdb/0x160\n blk_mq_update_nr_hw_queues+0x22b/0x560\n nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]\n nullb_device_poll_queues_store+0xa4/0x130 [null_blk]\n configfs_write_iter+0x109/0x1d0\n vfs_write+0x26e/0x6f0\n ksys_write+0x79/0x180\n __x64_sys_write+0x1d/0x30\n x64_sys_call+0x45c4/0x45f0\n do_syscall_64+0xa5/0x240\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from\nkcalloc(), and later ZERO_SIZE_PTR will be deferenced.\n\nFix the problem by checking numgrps first in group_cpus_evenly(), and\nreturn NULL directly if numgrps is zero.\n\n[(CVE-2025-38255)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix NULL pointer deference on eir_get_service_data\n\nThe len parameter is considered optional so it can be NULL so it cannot\nbe used for skipping to next entry of EIR_SERVICE_DATA.(CVE-2025-38304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Verify content returned by parse_int_array()\n\nThe first element of the returned array stores its length. If it is 0,\nany manipulation beyond the element at index 0 ends with null-ptr-deref.(CVE-2025-38307)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can\u0026apos;t move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \u0026quot;Dentry still in use\u0026quot; error, so add an error\nmessage that makes it clear this is what happened:\n\n[  495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[  495.281595] ------------[ cut here ]------------\n[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]\n[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we\u0026apos;re already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did.(CVE-2025-38321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI\u0026apos;m Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that “Acpi-State” cache and\n“Acpi-Parse” cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---(CVE-2025-38344)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmaple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()\n\nTemporarily clear the preallocation flag when explicitly requesting\nallocations.  Pre-existing allocations are already counted against the\nrequest through mas_node_count_gfp(), but the allocations will not happen\nif the MA_STATE_PREALLOC flag is set.  This flag is meant to avoid\nre-allocating in bulk allocation mode, and to detect issues with\npreallocation calculations.\n\nThe MA_STATE_PREALLOC flag should also always be set on zero allocations\nso that detection of underflow allocations will print a WARN_ON() during\nconsumption.\n\nUser visible effect of this flaw is a WARN_ON() followed by a null pointer\ndereference when subsequent requests for larger number of nodes is\nignored, such as the vma merge retry in mmap_region() caused by drivers\naltering the vma flags (which happens in v6.6, at least)(CVE-2025-38364)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_* TOCTOU\n\nTransport assignment may race with module unload. Protect new_transport\nfrom becoming a stale pointer.\n\nThis also takes care of an insecure call in vsock_use_local_transport();\nadd a lockdep assert.\n\nBUG: unable to handle page fault for address: fffffbfff8056000\nOops: Oops: 0000 [#1] SMP KASAN\nRIP: 0010:vsock_assign_transport+0x366/0x600\nCall Trace:\n vsock_connect+0x59c/0xc40\n __sys_connect+0xe8/0x100\n __x64_sys_connect+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38461)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_{g2h,h2g} TOCTOU\n\nvsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.\ntransport_{g2h,h2g} may become NULL after the NULL check.\n\nIntroduce vsock_transport_local_cid() to protect from a potential\nnull-ptr-deref.\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_find_cid+0x47/0x90\nCall Trace:\n __vsock_bind+0x4b2/0x720\n vsock_bind+0x90/0xe0\n __sys_bind+0x14d/0x1e0\n __x64_sys_bind+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0\nCall Trace:\n __x64_sys_ioctl+0x12d/0x190\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38462)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n  crypt_message()\n    // Allocate the creq buffer containing the req\n    creq = smb2_get_aead_req(..., \u0026amp;req);\n\n    // Async encryption returns -EINPROGRESS immediately\n    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n    // Free creq while async operation is still in progress\n    kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn\u0026apos;t\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn\u0026apos;t freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix.(CVE-2025-38488)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won\u0026apos;t expose something\nhidden by a mount we wouldn\u0026apos;t be able to undo.  \u0026quot;Wouldn\u0026apos;t be able to undo\u0026quot;\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere\u0026apos;s a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above.(CVE-2025-38499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: plug races between subflow fail and subflow creation\n\nWe have races similar to the one addressed by the previous patch between\nsubflow failing and additional subflow creation. They are just harder to\ntrigger.\n\nThe solution is similar. Use a separate flag to track the condition\n\u0026apos;socket state prevent any additional subflow creation\u0026apos; protected by the\nfallback lock.\n\nThe socket fallback makes such flag true, and also receiving or sending\nan MP_FAIL option.\n\nThe field \u0026apos;allow_infinite_fallback\u0026apos; is now always touched under the\nrelevant lock, we can drop the ONCE annotation on write.(CVE-2025-38552)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use aead_request_free to match aead_request_alloc\n\nUse aead_request_free() instead of kfree() to properly free memory\nallocated by aead_request_alloc(). This ensures sensitive crypto data\nis zeroed before being freed.(CVE-2025-38575)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Check governor before using governor-\u0026gt;name\n\nCommit 96ffcdf239de (\u0026quot;PM / devfreq: Remove redundant governor_name from\nstruct devfreq\u0026quot;) removes governor_name and uses governor-\u0026gt;name to replace\nit. But devfreq-\u0026gt;governor may be NULL and directly using\ndevfreq-\u0026gt;governor-\u0026gt;name may cause null pointer exception. Move the check of\ngovernor to before using governor-\u0026gt;name.(CVE-2025-38609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix refcount leak on table dump\n\nThere is a reference count leak in ctnetlink_dump_table():\n      if (res \u0026lt; 0) {\n                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general); // HERE\n                cb-\u0026gt;args[1] = (unsigned long)ct;\n                ...\n\nWhile its very unlikely, its possible that ct == last.\nIf this happens, then the refcount of ct was already incremented.\nThis 2nd increment is never undone.\n\nThis prevents the conntrack object from being released, which in turn\nkeeps prevents cnet-\u0026gt;count from dropping back to 0.\n\nThis will then block the netns dismantle (or conntrack rmmod) as\nnf_conntrack_cleanup_net_list() will wait forever.\n\nThis can be reproduced by running conntrack_resize.sh selftest in a loop.\nIt takes ~20 minutes for me on a preemptible kernel on average before\nI see a runaway kworker spinning in nf_conntrack_cleanup_net_list.\n\nOne fix would to change this to:\n        if (res \u0026lt; 0) {\n\t\tif (ct != last)\n\t                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general);\n\nBut this reference counting isn\u0026apos;t needed in the first place.\nWe can just store a cookie value instead.\n\nA followup patch will do the same for ctnetlink_exp_dump_table,\nit looks to me as if this has the same problem and like\nctnetlink_dump_table, we only need a \u0026apos;skip hint\u0026apos;, not the actual\nobject so we can apply the same cookie strategy there as well.(CVE-2025-38721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla4xxx: Prevent a potential error pointer dereference\n\nThe qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,\nbut qla4xxx_ep_connect() returns error pointers.  Propagating the error\npointers will lead to an Oops in the caller, so change the error pointers\nto NULL.(CVE-2025-39676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don\u0026apos;t know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don\u0026apos;t have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it\u0026apos;s\nzero length.(CVE-2025-39682)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this.(CVE-2025-39702)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: samsung: Fix UBSAN panic in samsung_clk_init()\n\nWith UBSAN_ARRAY_BOUNDS=y, I\u0026apos;m hitting the below panic due to\ndereferencing `ctx-\u0026gt;clk_data.hws` before setting\n`ctx-\u0026gt;clk_data.num = nr_clks`. Move that up to fix the crash.\n\n  UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n  \u0026lt;snip\u0026gt;\n  Call trace:\n   samsung_clk_init+0x110/0x124 (P)\n   samsung_clk_init+0x48/0x124 (L)\n   samsung_cmu_register_one+0x3c/0xa0\n   exynos_arm64_register_cmu+0x54/0x64\n   __gs101_cmu_top_of_clk_init_declare+0x28/0x60\n   ...(CVE-2025-39728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n  WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: \u0026gt; 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n   # echo 1073741816 \u0026gt; /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n   #include \u0026lt;unistd.h\u0026gt;\n   #include \u0026lt;sys/resource.h\u0026gt;\n\n   int main() {\n       struct rlimit rlim = {1073741824, 1073741824};\n       setrlimit(RLIMIT_NOFILE, \u0026amp;rlim);\n       dup2(2, 1073741880);  // Triggers the warning\n       return 0;\n   }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel\u0026apos;s allocation functions still enforce INT_MAX as a maximum\n   size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n   inadvertently trigger massive allocations\n3. The resulting allocations (\u0026gt;8GB) are impractical and will always fail\n\nsystemd\u0026apos;s algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical \u0026gt;8GB memory allocation request.(CVE-2025-39756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension headers, the kernel incorrectly requests checksum offload\nif the egress device only advertises NETIF_F_IPV6_CSUM feature, which has\na strict contract: it supports checksum offload only for plain TCP or UDP\nover IPv6 and explicitly does not support packets with extension headers.\nThe current GSO logic violates this contract by failing to disable the feature\nfor packets with extension headers, such as those used in GREoIPv6 tunnels.\n\nThis violation results in the device being asked to perform an operation\nit cannot support, leading to a `skb_warn_bad_offload` warning and a collapse\nof network throughput. While device TSO/USO is correctly bypassed in favor\nof software GSO for these packets, the GSO stack must be explicitly told not\nto request checksum offload.\n\nMask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4\nin gso_features_check if the IPv6 header contains extension headers to compute\nchecksum in software.\n\nThe exception is a BIG TCP extension, which, as stated in commit\n68e068cabd2c6c53 (\u0026quot;net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\u0026quot;):\n\u0026quot;The feature is only enabled on devices that support BIG TCP TSO.\nThe header is only present for PF_PACKET taps like tcpdump,\nand not transmitted by physical devices.\u0026quot;\n\nkernel log output (truncated):\nWARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_checksum_help+0x12a/0x1f0\n validate_xmit_skb+0x1a3/0x2d0\n validate_xmit_skb_list+0x4f/0x80\n sch_direct_xmit+0x1a2/0x380\n __dev_xmit_skb+0x242/0x670\n __dev_queue_xmit+0x3fc/0x7f0\n ip6_finish_output2+0x25e/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]\n ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre]\n dev_hard_start_xmit+0x63/0x1c0\n __dev_queue_xmit+0x6d0/0x7f0\n ip6_finish_output2+0x214/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n inet6_csk_xmit+0xeb/0x150\n __tcp_transmit_skb+0x555/0xa80\n tcp_write_xmit+0x32a/0xe90\n tcp_sendmsg_locked+0x437/0x1110\n tcp_sendmsg+0x2f/0x50\n...\nskb linear:   00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e\nskb linear:   00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00\nskb linear:   00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00\nskb linear:   00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00\nskb linear:   00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9\nskb linear:   00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01\nskb linear:   00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a(CVE-2025-39770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: initialize more fields in sctp_v6_from_sk()\n\nsyzbot found that sin6_scope_id was not properly initialized,\nleading to undefined behavior.\n\nClear sin6_scope_id and sin6_flowinfo.\n\nBUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983\n  sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390\n  sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452\n  sctp_get_port net/sctp/socket.c:8523 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n  x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable addr.i.i created at:\n  sctp_get_port net/sctp/socket.c:8515 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930(CVE-2025-39812)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix buffer free/clear order in deferred receive path\n\nFix a use-after-free window by correcting the buffer release sequence in\nthe deferred receive path. The code freed the RQ buffer first and only\nthen cleared the context pointer under the lock. Concurrent paths (e.g.,\nABTS and the repost path) also inspect and release the same pointer under\nthe lock, so the old order could lead to double-free/UAF.\n\nNote that the repost path already uses the correct pattern: detach the\npointer under the lock, then free it after dropping the lock. The\ndeferred path should do the same.(CVE-2025-39841)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n  RIP: 0010:br_nf_local_in+0x168/0x200\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   nf_hook_slow+0x3e/0xf0\n   br_pass_frame_up+0x103/0x180\n   br_handle_frame_finish+0x2de/0x5b0\n   br_nf_hook_thresh+0xc0/0x120\n   br_nf_pre_routing_finish+0x168/0x3a0\n   br_nf_pre_routing+0x237/0x5e0\n   br_handle_frame+0x1ec/0x3c0\n   __netif_receive_skb_core+0x225/0x1210\n   __netif_receive_skb_one_core+0x37/0xa0\n   netif_receive_skb+0x36/0x160\n   tun_get_user+0xa54/0x10c0\n   tun_chr_write_iter+0x65/0xb0\n   vfs_write+0x305/0x410\n   ksys_write+0x60/0xd0\n   do_syscall_64+0xa4/0x260\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb-\u0026gt;_nfct. However, br_nf_local_in() still use the\nold ct from local variable \u0026apos;nfct\u0026apos; after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it.(CVE-2025-39894)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer\n\nSince commit 7d5e9737efda (\u0026quot;net: rfkill: gpio: get the name and type from\ndevice property\u0026quot;) rfkill_find_type() gets called with the possibly\nuninitialized \u0026quot;const char *type_name;\u0026quot; local variable.\n\nOn x86 systems when rfkill-gpio binds to a \u0026quot;BCM4752\u0026quot; or \u0026quot;LNV4752\u0026quot;\nacpi_device, the rfkill-\u0026gt;type is set based on the ACPI acpi_device_id:\n\n        rfkill-\u0026gt;type = (unsigned)id-\u0026gt;driver_data;\n\nand there is no \u0026quot;type\u0026quot; property so device_property_read_string() will fail\nand leave type_name uninitialized, leading to a potential crash.\n\nrfkill_find_type() does accept a NULL pointer, fix the potential crash\nby initializing type_name to NULL.\n\nNote likely sofar this has not been caught because:\n\n1. Not many x86 machines actually have a \u0026quot;BCM4752\u0026quot;/\u0026quot;LNV4752\u0026quot; acpi_device\n2. The stack happened to contain NULL where type_name is stored(CVE-2025-39937)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)-\u0026gt;fastopen_rsk in tcp_disconnect().\n\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u0026gt;fastopen_rsk\nin the TCP_ESTABLISHED state. [0]\n\nsyzbot reused the server-side TCP Fast Open socket as a new client before\nthe TFO socket completes 3WHS:\n\n  1. accept()\n  2. connect(AF_UNSPEC)\n  3. connect() to another destination\n\nAs of accept(), sk-\u0026gt;sk_state is TCP_SYN_RECV, and tcp_disconnect() changes\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\n\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u0026gt;fastopen_rsk, the\nretransmit timer triggered the warning and the intended packet was not\nretransmitted.\n\nLet\u0026apos;s call reqsk_fastopen_remove() in tcp_disconnect().\n\n[0]:\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nModules linked in:\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u0026lt;0f\u0026gt; 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\n call_timer_fn (kernel/time/timer.c:1747)\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-39955)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Forbid FDB status change while nexthop is in a group\n\nThe kernel forbids the creation of non-FDB nexthop groups with FDB\nnexthops:\n\n # ip nexthop add id 1 via 192.0.2.1 fdb\n # ip nexthop add id 2 group 1\n Error: Non FDB nexthop group cannot have fdb nexthops.\n\nAnd vice versa:\n\n # ip nexthop add id 3 via 192.0.2.2 dev dummy1\n # ip nexthop add id 4 group 3 fdb\n Error: FDB nexthop group can only have fdb nexthops.\n\nHowever, as long as no routes are pointing to a non-FDB nexthop group,\nthe kernel allows changing the type of a nexthop from FDB to non-FDB and\nvice versa:\n\n # ip nexthop add id 5 via 192.0.2.2 dev dummy1\n # ip nexthop add id 6 group 5\n # ip nexthop replace id 5 via 192.0.2.2 fdb\n # echo $?\n 0\n\nThis configuration is invalid and can result in a NPD [1] since FDB\nnexthops are not associated with a nexthop device:\n\n # ip route add 198.51.100.1/32 nhid 6\n # ping 198.51.100.1\n\nFix by preventing nexthop FDB status change while the nexthop is in a\ngroup:\n\n # ip nexthop add id 7 via 192.0.2.2 dev dummy1\n # ip nexthop add id 8 group 7\n # ip nexthop replace id 7 via 192.0.2.2 fdb\n Error: Cannot change nexthop FDB status while in a group.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\n[...]\nOops: Oops: 0000 [#1] SMP\nCPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nRIP: 0010:fib_lookup_good_nhc+0x1e/0x80\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n fib_table_lookup+0x541/0x650\n ip_route_output_key_hash_rcu+0x2ea/0x970\n ip_route_output_key_hash+0x55/0x80\n __ip4_datagram_connect+0x250/0x330\n udp_connect+0x2b/0x60\n __sys_connect+0x9c/0xd0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0xa4/0x2a0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-39980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp-\u0026gt;app pointers are flushed, leading to a\nuse-after-free.\n\nFix this by introducing a global `exiting_module` flag, set to true in\nip_vs_ftp_exit() before unregistering the pernet subsystem. In\n__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns\ncleanup (when exiting_module is false) and defer it to\n__ip_vs_cleanup_batch(), which unregisters all apps after all connections\nare flushed. If called during module exit, unregister ip_vs_ftp\nimmediately.(CVE-2025-40018)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - set NULL to qm-\u0026gt;debug.qm_diff_regs\n\nWhen the initialization of qm-\u0026gt;debug.acc_diff_reg fails,\nthe probe process does not exit. However, after qm-\u0026gt;debug.qm_diff_regs is\nfreed, it is not set to NULL. This can lead to a double free when the\nremove process attempts to free it again. Therefore, qm-\u0026gt;debug.qm_diff_regs\nshould be set to NULL after it is freed.(CVE-2025-40062)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Explicitly check accesses to bpf_sock_addr\n\nSyzkaller found a kernel warning on the following sock_addr program:\n\n    0: r0 = 0\n    1: r2 = *(u32 *)(r1 +60)\n    2: exit\n\nwhich triggers:\n\n    verifier bug: error during ctx access conversion (0)\n\nThis is happening because offset 60 in bpf_sock_addr corresponds to an\nimplicit padding of 4 bytes, right after msg_src_ip4. Access to this\npadding isn\u0026apos;t rejected in sock_addr_is_valid_access and it thus later\nfails to convert the access.\n\nThis patch fixes it by explicitly checking the various fields of\nbpf_sock_addr in sock_addr_is_valid_access.\n\nI checked the other ctx structures and is_valid_access functions and\ndidn\u0026apos;t find any other similar cases. Other cases of (properly handled)\npadding are covered in new tests in a subsequent patch.(CVE-2025-40078)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.(CVE-2025-40136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid NULL dereference when chunk data buffer is missing\n\nchunk-\u0026gt;skb pointer is dereferenced in the if-block where it\u0026apos;s supposed\nto be NULL only.\n\nchunk-\u0026gt;skb can only be NULL if chunk-\u0026gt;head_skb is not. Check for frag_list\ninstead and do it just before replacing chunk-\u0026gt;skb. We\u0026apos;re sure that\notherwise chunk-\u0026gt;skb is non-NULL because of outer if() condition.(CVE-2025-40240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: remove never-working support for setting nsh fields\n\nThe validation of the set(nsh(...)) action is completely wrong.\nIt runs through the nsh_key_put_from_nlattr() function that is the\nsame function that validates NSH keys for the flow match and the\npush_nsh() action.  However, the set(nsh(...)) has a very different\nmemory layout.  Nested attributes in there are doubled in size in\ncase of the masked set().  That makes proper validation impossible.\n\nThere is also confusion in the code between the \u0026apos;masked\u0026apos; flag, that\nsays that the nested attributes are doubled in size containing both\nthe value and the mask, and the \u0026apos;is_mask\u0026apos; that says that the value\nwe\u0026apos;re parsing is the mask.  This is causing kernel crash on trying to\nwrite into mask part of the match with SW_FLOW_KEY_PUT() during\nvalidation, while validate_nsh() doesn\u0026apos;t allocate any memory for it:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)\n  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   validate_nsh+0x60/0x90 [openvswitch]\n   validate_set.constprop.0+0x270/0x3c0 [openvswitch]\n   __ovs_nla_copy_actions+0x477/0x860 [openvswitch]\n   ovs_nla_copy_actions+0x8d/0x100 [openvswitch]\n   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]\n   genl_family_rcv_msg_doit+0xdb/0x130\n   genl_family_rcv_msg+0x14b/0x220\n   genl_rcv_msg+0x47/0xa0\n   netlink_rcv_skb+0x53/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x280/0x3b0\n   netlink_sendmsg+0x1f7/0x430\n   ____sys_sendmsg+0x36b/0x3a0\n   ___sys_sendmsg+0x87/0xd0\n   __sys_sendmsg+0x6d/0xd0\n   do_syscall_64+0x7b/0x2c0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe third issue with this process is that while trying to convert\nthe non-masked set into masked one, validate_set() copies and doubles\nthe size of the OVS_KEY_ATTR_NSH as if it didn\u0026apos;t have any nested\nattributes.  It should be copying each nested attribute and doubling\nthem in size independently.  And the process must be properly reversed\nduring the conversion back from masked to a non-masked variant during\nthe flow dump.\n\nIn the end, the only two outcomes of trying to use this action are\neither validation failure or a kernel crash.  And if somehow someone\nmanages to install a flow with such an action, it will most definitely\nnot do what it is supposed to, since all the keys and the masks are\nmixed up.\n\nFixing all the issues is a complex task as it requires re-writing\nmost of the validation code.\n\nGiven that and the fact that this functionality never worked since\nintroduction, let\u0026apos;s just remove it altogether.  It\u0026apos;s better to\nre-introduce it later with a proper implementation instead of trying\nto fix it in stable releases.(CVE-2025-40254)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_mon_reinit_self().\n\nsyzbot reported use-after-free of tipc_net(net)-\u0026gt;monitors[]\nin tipc_mon_reinit_self(). [0]\n\nThe array is protected by RTNL, but tipc_mon_reinit_self()\niterates over it without RTNL.\n\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\nwhich is always under RTNL except for tipc_net_finalize_work().\n\nLet\u0026apos;s hold RTNL in tipc_net_finalize_work().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\n\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\n kasan_check_byte include/linux/kasan.h:399 [inline]\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\n process_one_work kernel/workqueue.c:3236 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 6089:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/\n---truncated---(CVE-2025-40280)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto\n\nsyzbot reported a possible shift-out-of-bounds [1]\n\nBlamed commit added rto_alpha_max and rto_beta_max set to 1000.\n\nIt is unclear if some sctp users are setting very large rto_alpha\nand/or rto_beta.\n\nIn order to prevent user regression, perform the test at run time.\n\nAlso add READ_ONCE() annotations as sysctl values can change under us.\n\n[1]\n\nUBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41\nshift exponent 64 is too large for 32-bit type \u0026apos;unsigned int\u0026apos;\nCPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:233 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494\n  sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509\n  sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502\n  sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338\n  sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]\n  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline](CVE-2025-40281)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: Prevent TOCTOU out-of-bounds write\n\nFor the following path not holding the sock lock,\n\n  sctp_diag_dump() -\u0026gt; sctp_for_each_endpoint() -\u0026gt; sctp_ep_dump()\n\nmake sure not to exceed bounds in case the address list has grown\nbetween buffer allocation (time-of-check) and write (time-of-use).(CVE-2025-40331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map-\u0026gt;max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map-\u0026gt;max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n  edits ](CVE-2025-68283)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ](CVE-2025-68284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix potential use-after-free in have_mon_and_osd_map()\n\nThe wait loop in __ceph_open_session() can race with the client\nreceiving a new monmap or osdmap shortly after the initial map is\nreceived.  Both ceph_monc_handle_map() and handle_one_map() install\na new map immediately after freeing the old one\n\n    kfree(monc-\u0026gt;monmap);\n    monc-\u0026gt;monmap = monmap;\n\n    ceph_osdmap_destroy(osdc-\u0026gt;osdmap);\n    osdc-\u0026gt;osdmap = newmap;\n\nunder client-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock respectively, but\nbecause neither is taken in have_mon_and_osd_map() it\u0026apos;s possible for\nclient-\u0026gt;monc.monmap-\u0026gt;epoch and client-\u0026gt;osdc.osdmap-\u0026gt;epoch arms in\n\n    client-\u0026gt;monc.monmap \u0026amp;\u0026amp; client-\u0026gt;monc.monmap-\u0026gt;epoch \u0026amp;\u0026amp;\n        client-\u0026gt;osdc.osdmap \u0026amp;\u0026amp; client-\u0026gt;osdc.osdmap-\u0026gt;epoch;\n\ncondition to dereference an already freed map.  This happens to be\nreproducible with generic/395 and generic/397 with KASAN enabled:\n\n    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70\n    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305\n    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266\n    ...\n    Call Trace:\n    \u0026lt;TASK\u0026gt;\n    have_mon_and_osd_map+0x56/0x70\n    ceph_open_session+0x182/0x290\n    ceph_get_tree+0x333/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n    \u0026lt;/TASK\u0026gt;\n\n    Allocated by task 13305:\n    ceph_osdmap_alloc+0x16/0x130\n    ceph_osdc_init+0x27a/0x4c0\n    ceph_create_client+0x153/0x190\n    create_fs_client+0x50/0x2a0\n    ceph_get_tree+0xff/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n    Freed by task 9475:\n    kfree+0x212/0x290\n    handle_one_map+0x23c/0x3b0\n    ceph_osdc_handle_map+0x3c9/0x590\n    mon_dispatch+0x655/0x6f0\n    ceph_con_process_message+0xc3/0xe0\n    ceph_con_v1_try_read+0x614/0x760\n    ceph_con_workfn+0x2de/0x650\n    process_one_work+0x486/0x7c0\n    process_scheduled_works+0x73/0x90\n    worker_thread+0x1c8/0x2a0\n    kthread+0x2ec/0x300\n    ret_from_fork+0x24/0x40\n    ret_from_fork_asm+0x1a/0x30\n\nRewrite the wait loop to check the above condition directly with\nclient-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock taken as appropriate.  While\nat it, improve the timeout handling (previously mount_timeout could be\nexceeded in case wait_event_interruptible_timeout() slept more than\nonce) and access client-\u0026gt;auth_err under client-\u0026gt;monc.mutex to match\nhow it\u0026apos;s set in finish_auth().\n\nmonmap_show() and osdmap_show() now take the respective lock before\naccessing the map as well.(CVE-2025-68285)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: lookup hci_conn on RX path on protocol side\n\nThe hdev lock/lookup/unlock/use pattern in the packet RX path doesn\u0026apos;t\nensure hci_conn* is not concurrently modified/deleted. This locking\nappears to be leftover from before conn_hash started using RCU\ncommit bf4c63252490b (\u0026quot;Bluetooth: convert conn hash to RCU\u0026quot;)\nand not clear if it had purpose since then.\n\nCurrently, there are code paths that delete hci_conn* from elsewhere\nthan the ordered hdev-\u0026gt;workqueue where the RX work runs in. E.g.\ncommit 5af1f84ed13a (\u0026quot;Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync\u0026quot;)\nintroduced some of these, and there probably were a few others before\nit.  It\u0026apos;s better to do the locking so that even if these run\nconcurrently no UAF is possible.\n\nMove the lookup of hci_conn and associated socket-specific conn to\nprotocol recv handlers, and do them within a single critical section\nto cover hci_conn* usage and lookup.\n\nsyzkaller has reported a crash that appears to be this issue:\n\n    [Task hdev-\u0026gt;workqueue]          [Task 2]\n                                    hci_disconnect_all_sync\n    l2cap_recv_acldata(hcon)\n                                      hci_conn_get(hcon)\n                                      hci_abort_conn_sync(hcon)\n                                        hci_dev_lock\n      hci_dev_lock\n                                        hci_conn_del(hcon)\n      v-------------------------------- hci_dev_unlock\n                                      hci_conn_put(hcon)\n      conn = hcon-\u0026gt;l2cap_data (UAF)(CVE-2025-68304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nima: Handle error code returned by ima_filter_rule_match()\n\nIn ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to\nthe rule being NULL, the function incorrectly skips the \u0026apos;if (!rc)\u0026apos; check\nand sets \u0026apos;result = true\u0026apos;. The LSM rule is considered a match, causing\nextra files to be measured by IMA.\n\nThis issue can be reproduced in the following scenario:\nAfter unloading the SELinux policy module via \u0026apos;semodule -d\u0026apos;, if an IMA\nmeasurement is triggered before ima_lsm_rules is updated,\nin ima_match_rules(), the first call to ima_filter_rule_match() returns\n-ESTALE. This causes the code to enter the \u0026apos;if (rc == -ESTALE \u0026amp;\u0026amp;\n!rule_reinitialized)\u0026apos; block, perform ima_lsm_copy_rule() and retry. In\nima_lsm_copy_rule(), since the SELinux module has been removed, the rule\nbecomes NULL, and the second call to ima_filter_rule_match() returns\n-ENOENT. This bypasses the \u0026apos;if (!rc)\u0026apos; check and results in a false match.\n\nCall trace:\n  selinux_audit_rule_match+0x310/0x3b8\n  security_audit_rule_match+0x60/0xa0\n  ima_match_rules+0x2e4/0x4a0\n  ima_match_policy+0x9c/0x1e8\n  ima_get_action+0x48/0x60\n  process_measurement+0xf8/0xa98\n  ima_bprm_check+0x98/0xd8\n  security_bprm_check+0x5c/0x78\n  search_binary_handler+0x6c/0x318\n  exec_binprm+0x58/0x1b8\n  bprm_execve+0xb8/0x130\n  do_execveat_common.isra.0+0x1a8/0x258\n  __arm64_sys_execve+0x48/0x68\n  invoke_syscall+0x50/0x128\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x44/0x200\n  el0t_64_sync_handler+0x100/0x130\n  el0t_64_sync+0x3c8/0x3d0\n\nFix this by changing \u0026apos;if (!rc)\u0026apos; to \u0026apos;if (rc \u0026lt;= 0)\u0026apos; to ensure that error\ncodes like -ENOENT do not bypass the check and accidentally result in a\nsuccessful match.(CVE-2025-68740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix invalid prog-\u0026gt;stats access when update_effective_progs fails\n\nSyzkaller triggers an invalid memory access issue following fault\ninjection in update_effective_progs. The issue can be described as\nfollows:\n\n__cgroup_bpf_detach\n  update_effective_progs\n    compute_effective_progs\n      bpf_prog_array_alloc \u0026lt;-- fault inject\n  purge_effective_progs\n    /* change to dummy_bpf_prog */\n    array-\u0026gt;items[index] = \u0026amp;dummy_bpf_prog.prog\n\n---softirq start---\n__do_softirq\n  ...\n    __cgroup_bpf_run_filter_skb\n      __bpf_prog_run_save_cb\n        bpf_prog_run\n          stats = this_cpu_ptr(prog-\u0026gt;stats)\n          /* invalid memory access */\n          flags = u64_stats_update_begin_irqsave(\u0026amp;stats-\u0026gt;syncp)\n---softirq end---\n\n  static_branch_dec(\u0026amp;cgroup_bpf_enabled_key[atype])\n\nThe reason is that fault injection caused update_effective_progs to fail\nand then changed the original prog into dummy_bpf_prog.prog in\npurge_effective_progs. Then a softirq came, and accessing the members of\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\n\nTo fix it, skip updating stats when stats is NULL.(CVE-2025-68742)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nethtool: Avoid overflowing userspace buffer on stats query\n\nThe ethtool -S command operates across three ioctl calls:\nETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and\nETHTOOL_GSTATS for the values.\n\nIf the number of stats changes between these calls (e.g., due to device\nreconfiguration), userspace\u0026apos;s buffer allocation will be incorrect,\npotentially leading to buffer overflow.\n\nDrivers are generally expected to maintain stable stat counts, but some\ndrivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making\nthis scenario possible.\n\nSome drivers try to handle this internally:\n- bnad_get_ethtool_stats() returns early in case stats.n_stats is not\n  equal to the driver\u0026apos;s stats count.\n- micrel/ksz884x also makes sure not to write anything beyond\n  stats.n_stats and overflow the buffer.\n\nHowever, both use stats.n_stats which is already assigned with the value\nreturned from get_sset_count(), hence won\u0026apos;t solve the issue described\nhere.\n\nChange ethtool_get_strings(), ethtool_get_stats(),\nethtool_get_phy_stats() to not return anything in case of a mismatch\nbetween userspace\u0026apos;s size and get_sset_size(), to prevent buffer\noverflow.\nThe returned n_stats value will be equal to zero, to reflect that\nnothing has been returned.\n\nThis could result in one of two cases when using upstream ethtool,\ndepending on when the size change is detected:\n1. When detected in ethtool_get_strings():\n    # ethtool -S eth2\n    no stats available\n\n2. When detected in get stats, all stats will be reported as zero.\n\nBoth cases are presumably transient, and a subsequent ethtool call\nshould succeed.\n\nOther than the overflow avoidance, these two cases are very evident (no\noutput/cleared stats), which is arguably better than presenting\nincorrect/shifted stats.\nI also considered returning an error instead of a \u0026quot;silent\u0026quot; response, but\nthat seems more destructive towards userspace apps.\n\nNotes:\n- This patch does not claim to fix the inherent race, it only makes sure\n  that we do not overflow the userspace buffer, and makes for a more\n  predictable behavior.\n\n- RTNL lock is held during each ioctl, the race window exists between\n  the separate ioctl calls when the lock is released.\n\n- Userspace ethtool always fills stats.n_stats, but it is likely that\n  these stats ioctls are implemented in other userspace applications\n  which might not fill it. The added code checks that it\u0026apos;s not zero,\n  to prevent any regressions.(CVE-2025-68795)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: xattr: fix null pointer deref in ext4_raw_inode()\n\nIf ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED),\niloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all()\nlacks error checking, this will lead to a null pointer dereference\nin ext4_raw_inode(), called right after ext4_get_inode_loc().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68820)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: using the num_tqps in the vf driver to apply for resources\n\nCurrently, hdev-\u0026gt;htqp is allocated using hdev-\u0026gt;num_tqps, and kinfo-\u0026gt;tqp\nis allocated using kinfo-\u0026gt;num_tqps. However, kinfo-\u0026gt;num_tqps is set to\nmin(new_tqps, hdev-\u0026gt;num_tqps);  Therefore, kinfo-\u0026gt;num_tqps may be smaller\nthan hdev-\u0026gt;num_tqps, which causes some hdev-\u0026gt;htqp[i] to remain\nuninitialized in hclgevf_knic_setup().\n\nThus, this patch allocates hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp using hdev-\u0026gt;num_tqps,\nensuring that the lengths of hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp are consistent\nand that all elements are properly initialized.(CVE-2025-71064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u0026gt;leaf_qdisc-\u0026gt;q.qlen \u0026gt; 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u0026gt;q.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u0026gt;q.qlen == 0, but its class\u0026apos;s leaf\nqdisc-\u0026gt;q.qlen \u0026gt; 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    0.903571] #PF: supervisor write access in kernel mode\n[    0.903860] #PF: error_code(0x0002) - not-present page\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n===========================================\n   0:\t0f 84 4d 01 00 00    \tje     0x153\n   6:\t48 89 70 18          \tmov    %rsi,0x18(%rax)\n   a:\t8b 4b 10             \tmov    0x10(%rbx),%ecx\n   d:\t48 c7 c2 ff ff ff ff \tmov    $0xffffffffffffffff,%rdx\n  14:\t48 8b 78 08          \tmov    0x8(%rax),%rdi\n  18:\t48 d3 e2             \tshl    %cl,%rdx\n  1b:\t48 21 f2             \tand    %rsi,%rdx\n  1e:\t48 2b 13             \tsub    (%rbx),%rdx\n  21:\t48 8b 30             \tmov    (%rax),%rsi\n  24:\t48 d3 ea             \tshr    %cl,%rdx\n  27:\t8b 4b 18             \tmov    0x18(%rbx),%ecx\n\t...\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[    0.910247] PKRU: 55555554\n[    0.910391] Call Trace:\n[    0.910527]  \u0026lt;TASK\u0026gt;\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\n[    0.912484]  netlink_sendmsg (net/netlink/af\n---truncated---(CVE-2026-22976)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\u0026quot;bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\u0026quot;), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\u0026quot;bpf: introduce frags support to\nbpf_prog_test_run_xdp()\u0026quot;) forgot to call xdp_convert_buff_to_md().(CVE-2026-22994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a deadlock involving nfs_release_folio()\n\nWang Zhaolong reports a deadlock involving NFSv4.1 state recovery\nwaiting on kthreadd, which is attempting to reclaim memory by calling\nnfs_release_folio(). The latter cannot make progress due to state\nrecovery being needed.\n\nIt seems that the only safe thing to do here is to kick off a writeback\nof the folio, without waiting for completion, or else kicking off an\nasynchronous commit.(CVE-2026-23053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: fix wrong reinitialization of ringbuffer on reopen\n\ndvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the\nDVR device.  dvb_ringbuffer_init() calls init_waitqueue_head(), which\nreinitializes the waitqueue list head to empty.\n\nSince dmxdev-\u0026gt;dvr_buffer.queue is a shared waitqueue (all opens of the\nsame DVR device share it), this orphans any existing waitqueue entries\nfrom io_uring poll or epoll, leaving them with stale prev/next pointers\nwhile the list head is reset to {self, self}.\n\nThe waitqueue and spinlock in dvr_buffer are already properly\ninitialized once in dvb_dmxdev_init().  The open path only needs to\nreset the buffer data pointer, size, and read/write positions.\n\nReplace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct\nassignment of data/size and a call to dvb_ringbuffer_reset(), which\nproperly resets pread, pwrite, and error with correct memory ordering\nwithout touching the waitqueue or spinlock.(CVE-2026-23253)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregmap: maple: free entry on mas_store_gfp() failure\n\nregcache_maple_write() allocates a new block (\u0026apos;entry\u0026apos;) to merge\nadjacent ranges and then stores it with mas_store_gfp().\nWhen mas_store_gfp() fails, the new \u0026apos;entry\u0026apos; remains allocated and\nis never freed, leaking memory.\n\nFree \u0026apos;entry\u0026apos; on the failure path; on success continue freeing the\nreplaced neighbor blocks (\u0026apos;lower\u0026apos;, \u0026apos;upper\u0026apos;).(CVE-2026-23260)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.(CVE-2026-23268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.(CVE-2026-23271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: observe an RCU grace period in macvlan_common_newlink() error path\n\nvalis reported that a race condition still happens after my prior patch.\n\nmacvlan_common_newlink() might have made @dev visible before\ndetecting an error, and its caller will directly call free_netdev(dev).\n\nWe must respect an RCU period, either in macvlan or the core networking\nstack.\n\nAfter adding a temporary mdelay(1000) in macvlan_forward_source_one()\nto open the race window, valis repro was:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\nip link add mv0 link p2 type macvlan mode source\n\n(ip link add invalid% link p2 type macvlan mode source macaddr add\n00:00:00:00:00:20 \u0026amp;) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4\nPING 1.2.3.4 (1.2.3.4): 56 data bytes\nRTNETLINK answers: Invalid argument\n\nBUG: KASAN: slab-use-after-free in macvlan_forward_source\n(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nRead of size 8 at addr ffff888016bb89c0 by task e/175\n\nCPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n\u0026lt;IRQ\u0026gt;\ndump_stack_lvl (lib/dump_stack.c:123)\nprint_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nkasan_report (mm/kasan/report.c:597)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nmacvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\n? tasklet_init (kernel/softirq.c:983)\nmacvlan_handle_frame (drivers/net/macvlan.c:501)\n\nAllocated by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\n__kasan_kmalloc (mm/kasan/common.c:419)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657\nmm/slub.c:7140)\nalloc_netdev_mqs (net/core/dev.c:12012)\nrtnl_create_link (net/core/rtnetlink.c:3648)\nrtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nFreed by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\nkasan_save_free_info (mm/kasan/generic.c:587)\n__kasan_slab_free (mm/kasan/common.c:287)\nkfree (mm/slub.c:6674 mm/slub.c:6882)\nrtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)(CVE-2026-23273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix recursive locking in __configfs_open_file()\n\nIn flush_write_buffer, \u0026amp;p-\u0026gt;frag_sem is acquired and then the loaded store\nfunction is called, which, here, is target_core_item_dbroot_store().  This\nfunction called filp_open(), following which these functions were called\n(in reverse order), according to the call trace:\n\n  down_read\n  __configfs_open_file\n  do_dentry_open\n  vfs_open\n  do_open\n  path_openat\n  do_filp_open\n  file_open_name\n  filp_open\n  target_core_item_dbroot_store\n  flush_write_buffer\n  configfs_write_iter\n\ntarget_core_item_dbroot_store() tries to validate the new file path by\ntrying to open the file path provided to it; however, in this case, the bug\nreport shows:\n\ndb_root: not a directory: /sys/kernel/config/target/dbroot\n\nindicating that the same configfs file was tried to be opened, on which it\nis currently working on. Thus, it is trying to acquire frag_sem semaphore\nof the same file of which it already holds the semaphore obtained in\nflush_write_buffer(), leading to acquiring the semaphore in a nested manner\nand a possibility of recursive locking.\n\nFix this by modifying target_core_item_dbroot_store() to use kern_path()\ninstead of filp_open() to avoid opening the file using filesystem-specific\nfunction __configfs_open_file(), and further modifying it to make this fix\ncompatible.(CVE-2026-23292)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\n\nPID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: \u0026quot;iscsid\u0026quot;\n #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef(CVE-2026-23296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix preempt count leak in napi poll tracepoint\n\nUsing get_cpu() in the tracepoint assignment causes an obvious preempt\ncount leak because nothing invokes put_cpu() to undo it:\n\n  softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?\n\nThis clearly has seen a lot of testing in the last 3+ years...\n\nUse smp_processor_id() instead.(CVE-2026-23313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nBefore the referenced fixes these functions used a lookup function that\nreturned a pointer. This was changed to another lookup function that\nreturned an error code with the pointer becoming an out parameter.\n\nThe error path when the lookup failed was not changed to reflect this\nchange and the code continued to return the PTR_ERR of the now\nuninitialized pointer. This could cause the vmw_translate_ptr functions\nto return success when they actually failed causing further uninitialized\nand OOB accesses.(CVE-2026-23317)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when \u0026apos;bpf_link_put\u0026apos; reduces the\nrefcount of \u0026apos;shim_link-\u0026gt;link.link\u0026apos; to zero, the resource is considered\nreleased but may still be referenced via \u0026apos;tr-\u0026gt;progs_hlist\u0026apos; in\n\u0026apos;cgroup_shim_find\u0026apos;. The actual cleanup of \u0026apos;tr-\u0026gt;progs_hlist\u0026apos; in\n\u0026apos;bpf_shim_tramp_link_release\u0026apos; is deferred. During this window, another\nprocess can cause a use-after-free via \u0026apos;bpf_trampoline_link_cgroup_shim\u0026apos;.\n\nBased on Martin KaFai Lau\u0026apos;s suggestions, I have created a simple patch.\n\nTo fix this:\n   Add an atomic non-zero check in \u0026apos;bpf_trampoline_link_cgroup_shim\u0026apos;.\n   Only increment the refcount if it is not already zero.\n\nTesting:\n   I verified the fix by adding a delay in\n   \u0026apos;bpf_shim_tramp_link_release\u0026apos; to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u0026gt;trampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026amp;shim_link-\u0026gt;link,\n\t\tshim_link-\u0026gt;trampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u0026gt;trampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM\u0026apos;s report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.(CVE-2026-23319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won\u0026apos;t be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that\u0026apos;s undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete.(CVE-2026-23352)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path.(CVE-2026-23359)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin queue leak on controller reset\n\nWhen nvme_alloc_admin_tag_set() is called during a controller reset,\na previous admin queue may still exist. Release it properly before\nallocating a new one to avoid orphaning the old queue.\n\nThis fixes a regression introduced by commit 03b3bcd319b3 (\u0026quot;nvme: fix\nadmin request_queue lifetime\u0026quot;).(CVE-2026-23360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix __this_cpu_read/write in preemptible context\n\ntracing_record_cmdline() internally uses __this_cpu_read() and\n__this_cpu_write() on the per-CPU variable trace_cmdline_save, and\ntrace_save_cmdline() explicitly asserts preemption is disabled via\nlockdep_assert_preemption_disabled(). These operations are only safe\nwhen preemption is off, as they were designed to be called from the\nscheduler context (probe_wakeup_sched_switch() / probe_wakeup()).\n\n__blk_add_trace() was calling tracing_record_cmdline(current) early in\nthe blk_tracer path, before ring buffer reservation, from process\ncontext where preemption is fully enabled. This triggers the following\nusing blktests/blktrace/002:\n\nblktrace/002 (blktrace ftrace corruption with sysfs trace)   [failed]\n    runtime  0.367s  ...  0.437s\n    something found in dmesg:\n    [   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n    [   81.239580] null_blk: disk nullb1 created\n    [   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n    [   81.362842] caller is tracing_record_cmdline+0x10/0x40\n    [   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n    [   81.362877] Tainted: [N]=TEST\n    [   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n    [   81.362881] Call Trace:\n    [   81.362884]  \u0026lt;TASK\u0026gt;\n    [   81.362886]  dump_stack_lvl+0x8d/0xb0\n    ...\n    (See \u0026apos;/mnt/sda/blktests/results/nodev/blktrace/002.dmesg\u0026apos; for the entire message)\n\n[   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n[   81.239580] null_blk: disk nullb1 created\n[   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n[   81.362842] caller is tracing_record_cmdline+0x10/0x40\n[   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n[   81.362877] Tainted: [N]=TEST\n[   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[   81.362881] Call Trace:\n[   81.362884]  \u0026lt;TASK\u0026gt;\n[   81.362886]  dump_stack_lvl+0x8d/0xb0\n[   81.362895]  check_preemption_disabled+0xce/0xe0\n[   81.362902]  tracing_record_cmdline+0x10/0x40\n[   81.362923]  __blk_add_trace+0x307/0x5d0\n[   81.362934]  ? lock_acquire+0xe0/0x300\n[   81.362940]  ? iov_iter_extract_pages+0x101/0xa30\n[   81.362959]  blk_add_trace_bio+0x106/0x1e0\n[   81.362968]  submit_bio_noacct_nocheck+0x24b/0x3a0\n[   81.362979]  ? lockdep_init_map_type+0x58/0x260\n[   81.362988]  submit_bio_wait+0x56/0x90\n[   81.363009]  __blkdev_direct_IO_simple+0x16c/0x250\n[   81.363026]  ? __pfx_submit_bio_wait_endio+0x10/0x10\n[   81.363038]  ? rcu_read_lock_any_held+0x73/0xa0\n[   81.363051]  blkdev_read_iter+0xc1/0x140\n[   81.363059]  vfs_read+0x20b/0x330\n[   81.363083]  ksys_read+0x67/0xe0\n[   81.363090]  do_syscall_64+0xbf/0xf00\n[   81.363102]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   81.363106] RIP: 0033:0x7f281906029d\n[   81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec\n[   81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[   81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d\n[   81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000\n[   81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000\n[   81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000\n[   81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a\n[   81.363142]  \u0026lt;/TASK\u0026gt;\n\nThe same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),\nand blk_add_trace_rq() paths as well.\n\nThe purpose of tracin\n---truncated---(CVE-2026-23374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing\n\nstruct bpf_plt contains a u64 target field. Currently, the BPF JIT\nallocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT\nbuffer.\n\nBecause the base address of the JIT buffer can be 4-byte aligned (e.g.,\nending in 0x4 or 0xc), the relative padding logic in build_plt() fails\nto ensure that target lands on an 8-byte boundary.\n\nThis leads to two issues:\n1. UBSAN reports misaligned-access warnings when dereferencing the\n   structure.\n2. More critically, target is updated concurrently via WRITE_ONCE() in\n   bpf_arch_text_poke() while the JIT\u0026apos;d code executes ldr. On arm64,\n   64-bit loads/stores are only guaranteed to be single-copy atomic if\n   they are 64-bit aligned. A misaligned target risks a torn read,\n   causing the JIT to jump to a corrupted address.\n\nFix this by increasing the allocation alignment requirement to 8 bytes\n(sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of\nthe JIT buffer to an 8-byte boundary, allowing the relative padding math\nin build_plt() to correctly align the target field.(CVE-2026-23383)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \u0026quot;general protection fault in squashfs_copy_data\u0026quot;\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata.  This will trap this and other cases.(CVE-2026-23388)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit.(CVE-2026-31447)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report\u0026apos;s feature request using a completely different report\nID.  This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested.  If it doesn\u0026apos;t, omit reporting the raw event and\nreturn early.(CVE-2026-43047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Mitigate potential OOB by removing bogus memset()\n\nThe memset() in hid_report_raw_event() has the good intention of\nclearing out bogus data by zeroing the area from the end of the incoming\ndata string to the assumed end of the buffer.  However, as we have\npreviously seen, doing so can easily result in OOB reads and writes in\nthe subsequent thread of execution.\n\nThe current suggestion from one of the HID maintainers is to remove the\nmemset() and simply return if the incoming event buffer size is not\nlarge enough to fill the associated report.\n\nSuggested-by Benjamin Tissoires \u0026lt;(CVE-2026-43048)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks.  The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks.  Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk.  On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n XFS (pmem0): metadata I/O error in \u0026quot;xfs_da_read_buf+0x104/0x190\u0026quot; at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction.  This eliminates the window where\nthe parent holds a pointer to a cancelled block.  Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases.  First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction.  The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation.(CVE-2026-43053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\u0026quot;\n\nThis reverts commit 05703271c3cd (\u0026quot;PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\u0026quot;), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n  $ echo \u0026lt;NUM\u0026gt; \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/sriov_numvfs\n  $ echo 1 \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n  zsh/5715 is trying to acquire lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n  but task is already holding lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n  ...\n  Call Trace:\n   [\u0026lt;00000259778c4f90\u0026gt;] dump_stack_lvl+0xc0/0x110\n   [\u0026lt;00000259779c844e\u0026gt;] print_deadlock_bug+0x31e/0x330\n   [\u0026lt;00000259779c1908\u0026gt;] __lock_acquire+0x16c8/0x32f0\n   [\u0026lt;00000259779bffac\u0026gt;] lock_acquire+0x14c/0x350\n   [\u0026lt;00000259789643a6\u0026gt;] __mutex_lock_common+0xe6/0x1520\n   [\u0026lt;000002597896413c\u0026gt;] mutex_lock_nested+0x3c/0x50\n   [\u0026lt;00000259784a07e4\u0026gt;] sriov_disable+0x34/0x140\n   [\u0026lt;00000258f7d6dd80\u0026gt;] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n   [\u0026lt;00000258f7d5745e\u0026gt;] remove_one+0x5e/0xf0 [mlx5_core]\n   [\u0026lt;00000259784857fc\u0026gt;] pci_device_remove+0x3c/0xa0\n   [\u0026lt;000002597851012e\u0026gt;] device_release_driver_internal+0x18e/0x280\n   [\u0026lt;000002597847ae22\u0026gt;] pci_stop_bus_device+0x82/0xa0\n   [\u0026lt;000002597847afce\u0026gt;] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n   [\u0026lt;00000259784972c2\u0026gt;] remove_store+0x72/0x90\n   [\u0026lt;0000025977e6661a\u0026gt;] kernfs_fop_write_iter+0x15a/0x200\n   [\u0026lt;0000025977d7241c\u0026gt;] vfs_write+0x24c/0x300\n   [\u0026lt;0000025977d72696\u0026gt;] ksys_write+0x86/0x110\n   [\u0026lt;000002597895b61c\u0026gt;] __do_syscall+0x14c/0x400\n   [\u0026lt;000002597896e0ee\u0026gt;] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on.(CVE-2026-43147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: Add support for TSV110 Spectre-BHB mitigation\n\nThe TSV110 processor is vulnerable to the Spectre-BHB (Branch History\nBuffer) attack, which can be exploited to leak information through\nbranch prediction side channels. This commit adds the MIDR of TSV110\nto the list for software mitigation.(CVE-2026-43261)\n\nIn the Linux kernel, the kexec_load_purgatory() function derives image-\u0026gt;start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image-\u0026gt;start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol.(CVE-2026-43289)\n\nIn the Linux kernel, there is a potential out-of-bounds access vulnerability in the ceph_handle_auth_reply() function of the libceph component. When processing messages of type CEPH_MSG_AUTH_REPLY, the value of the payload_len field is stored in a variable of type int. A value greater than INT_MAX leads to integer overflow and is interpreted as a negative value, which causes the pointer address to be decremented and subsequently accessed because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. The vulnerability is fixed by changing the data type of payload_len to u32 and introducing additional sanity checks.(CVE-2026-43407)\n\nIn the Linux kernel, when an alias is found through d_splice_alias in the nfs3_proc_create function, if the alias happens to be a directory dentry, the system does not return any error but simply forgets about this alias, leaving the original dentry to be added as negative. This later causes a system crash in nfs_atomic_open_v23/finish_open since a negative dentry is supplied to do_dentry_open. This issue was observed running lustre-racer, where directories and files are created/removed concurrently with the same name and O_EXCL is not used to open files.(CVE-2026-43470)","status":"published","published":"2026-05-22T11:11:22Z","modified":"2026-08-18T01:20:02.121651445Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2493","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix recursive locking in __configfs_open_file()\n\nIn flush_write_buffer, \u0026amp;p-\u0026gt;frag_sem is acquired and then the loaded store\nfunction is called, which, here, is target_core_item_dbroot_store().  This\nfunction called filp_open(), following which these functions were called\n(in reverse order), according to the call trace:\n\n  down_read\n  __configfs_open_file\n  do_dentry_open\n  vfs_open\n  do_open\n  path_openat\n  do_filp_open\n  file_open_name\n  filp_open\n  target_core_item_dbroot_store\n  flush_write_buffer\n  configfs_write_iter\n\ntarget_core_item_dbroot_store() tries to validate the new file path by\ntrying to open the file path provided to it; however, in this case, the bug\nreport shows:\n\ndb_root: not a directory: /sys/kernel/config/target/dbroot\n\nindicating that the same configfs file was tried to be opened, on which it\nis currently working on. Thus, it is trying to acquire frag_sem semaphore\nof the same file of which it already holds the semaphore obtained in\nflush_write_buffer(), leading to acquiring the semaphore in a nested manner\nand a possibility of recursive locking.\n\nFix this by modifying target_core_item_dbroot_store() to use kern_path()\ninstead of filp_open() to avoid opening the file using filesystem-specific\nfunction __configfs_open_file(), and further modifying it to make this fix\ncompatible.(CVE-2026-23292)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\n\nPID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: \u0026quot;iscsid\u0026quot;\n #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef(CVE-2026-23296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix preempt count leak in napi poll tracepoint\n\nUsing get_cpu() in the tracepoint assignment causes an obvious preempt\ncount leak because nothing invokes put_cpu() to undo it:\n\n  softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?\n\nThis clearly has seen a lot of testing in the last 3+ years...\n\nUse smp_processor_id() instead.(CVE-2026-23313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nBefore the referenced fixes these functions used a lookup function that\nreturned a pointer. This was changed to another lookup function that\nreturned an error code with the pointer becoming an out parameter.\n\nThe error path when the lookup failed was not changed to reflect this\nchange and the code continued to return the PTR_ERR of the now\nuninitialized pointer. This could cause the vmw_translate_ptr functions\nto return success when they actually failed causing further uninitialized\nand OOB accesses.(CVE-2026-23317)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won\u0026apos;t be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that\u0026apos;s undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete.(CVE-2026-23352)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin queue leak on controller reset\n\nWhen nvme_alloc_admin_tag_set() is called during a controller reset,\na previous admin queue may still exist. Release it properly before\nallocating a new one to avoid orphaning the old queue.\n\nThis fixes a regression introduced by commit 03b3bcd319b3 (\u0026quot;nvme: fix\nadmin request_queue lifetime\u0026quot;).(CVE-2026-23360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix __this_cpu_read/write in preemptible context\n\ntracing_record_cmdline() internally uses __this_cpu_read() and\n__this_cpu_write() on the per-CPU variable trace_cmdline_save, and\ntrace_save_cmdline() explicitly asserts preemption is disabled via\nlockdep_assert_preemption_disabled(). These operations are only safe\nwhen preemption is off, as they were designed to be called from the\nscheduler context (probe_wakeup_sched_switch() / probe_wakeup()).\n\n__blk_add_trace() was calling tracing_record_cmdline(current) early in\nthe blk_tracer path, before ring buffer reservation, from process\ncontext where preemption is fully enabled. This triggers the following\nusing blktests/blktrace/002:\n\nblktrace/002 (blktrace ftrace corruption with sysfs trace)   [failed]\n    runtime  0.367s  ...  0.437s\n    something found in dmesg:\n    [   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n    [   81.239580] null_blk: disk nullb1 created\n    [   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n    [   81.362842] caller is tracing_record_cmdline+0x10/0x40\n    [   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n    [   81.362877] Tainted: [N]=TEST\n    [   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n    [   81.362881] Call Trace:\n    [   81.362884]  \u0026lt;TASK\u0026gt;\n    [   81.362886]  dump_stack_lvl+0x8d/0xb0\n    ...\n    (See \u0026apos;/mnt/sda/blktests/results/nodev/blktrace/002.dmesg\u0026apos; for the entire message)\n\n[   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n[   81.239580] null_blk: disk nullb1 created\n[   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n[   81.362842] caller is tracing_record_cmdline+0x10/0x40\n[   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n[   81.362877] Tainted: [N]=TEST\n[   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[   81.362881] Call Trace:\n[   81.362884]  \u0026lt;TASK\u0026gt;\n[   81.362886]  dump_stack_lvl+0x8d/0xb0\n[   81.362895]  check_preemption_disabled+0xce/0xe0\n[   81.362902]  tracing_record_cmdline+0x10/0x40\n[   81.362923]  __blk_add_trace+0x307/0x5d0\n[   81.362934]  ? lock_acquire+0xe0/0x300\n[   81.362940]  ? iov_iter_extract_pages+0x101/0xa30\n[   81.362959]  blk_add_trace_bio+0x106/0x1e0\n[   81.362968]  submit_bio_noacct_nocheck+0x24b/0x3a0\n[   81.362979]  ? lockdep_init_map_type+0x58/0x260\n[   81.362988]  submit_bio_wait+0x56/0x90\n[   81.363009]  __blkdev_direct_IO_simple+0x16c/0x250\n[   81.363026]  ? __pfx_submit_bio_wait_endio+0x10/0x10\n[   81.363038]  ? rcu_read_lock_any_held+0x73/0xa0\n[   81.363051]  blkdev_read_iter+0xc1/0x140\n[   81.363059]  vfs_read+0x20b/0x330\n[   81.363083]  ksys_read+0x67/0xe0\n[   81.363090]  do_syscall_64+0xbf/0xf00\n[   81.363102]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   81.363106] RIP: 0033:0x7f281906029d\n[   81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec\n[   81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[   81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d\n[   81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000\n[   81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000\n[   81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000\n[   81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a\n[   81.363142]  \u0026lt;/TASK\u0026gt;\n\nThe same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),\nand blk_add_trace_rq() paths as well.\n\nThe purpose of tracin\n---truncated---(CVE-2026-23374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing\n\nstruct bpf_plt contains a u64 target field. Currently, the BPF JIT\nallocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT\nbuffer.\n\nBecause the base address of the JIT buffer can be 4-byte aligned (e.g.,\nending in 0x4 or 0xc), the relative padding logic in build_plt() fails\nto ensure that target lands on an 8-byte boundary.\n\nThis leads to two issues:\n1. UBSAN reports misaligned-access warnings when dereferencing the\n   structure.\n2. More critically, target is updated concurrently via WRITE_ONCE() in\n   bpf_arch_text_poke() while the JIT\u0026apos;d code executes ldr. On arm64,\n   64-bit loads/stores are only guaranteed to be single-copy atomic if\n   they are 64-bit aligned. A misaligned target risks a torn read,\n   causing the JIT to jump to a corrupted address.\n\nFix this by increasing the allocation alignment requirement to 8 bytes\n(sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of\nthe JIT buffer to an 8-byte boundary, allowing the relative padding math\nin build_plt() to correctly align the target field.(CVE-2026-23383)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable-\u0026gt;hash and udptable-\u0026gt;hash2) for collision\ndetection. The current code switches to \u0026quot;hash2\u0026quot; when\nhslot-\u0026gt;count \u0026gt; 10.\n\n\u0026quot;hash2\u0026quot; is keyed by local address and local port.\n\u0026quot;hash\u0026quot; is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1,  \u0026quot;[fd00::1]:8888\u0026quot;)\nbind(fd2,  \u0026quot;[fd00::2]:8888\u0026quot;)\nbind(fd3,  \u0026quot;[fd00::3]:8888\u0026quot;)\nbind(fd4,  \u0026quot;[fd00::4]:8888\u0026quot;)\nbind(fd5,  \u0026quot;[fd00::5]:8888\u0026quot;)\nbind(fd6,  \u0026quot;[fd00::6]:8888\u0026quot;)\nbind(fd7,  \u0026quot;[fd00::7]:8888\u0026quot;)\nbind(fd8,  \u0026quot;[fd00::8]:8888\u0026quot;)\nbind(fd9,  \u0026quot;[fd00::9]:8888\u0026quot;)\nbind(fd10, \u0026quot;[fd00::10]:8888\u0026quot;)\n\n/* Correctly return -EADDRINUSE because \u0026quot;hash\u0026quot; is used\n * instead of \u0026quot;hash2\u0026quot;. udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \u0026quot;[::]:8888\u0026quot;)\n\n/* After one more socket is bound to \u0026quot;[fd00::11]:8888\u0026quot;,\n * hslot-\u0026gt;count exceeds 10 and \u0026quot;hash2\u0026quot; is used instead.\n */\nbind(fd11, \u0026quot;[fd00::11]:8888\u0026quot;)\nbind(fail_fd, \u0026quot;[::]:8888\u0026quot;)      /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \u0026quot;0.0.0.0\u0026quot;\nand the IPv4-mapped wildcard address \u0026quot;::ffff:0.0.0.0\u0026quot;. For\nexample, if there are existing sockets bound to\n\u0026quot;192.168.1.[1-11]:8888\u0026quot;, then binding \u0026quot;0.0.0.0:8888\u0026quot; or\n\u0026quot;[::ffff:0.0.0.0]:8888\u0026quot; can also miss the conflict when\nhslot-\u0026gt;count \u0026gt; 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix.(CVE-2026-31503)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31752)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks.  The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks.  Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk.  On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n XFS (pmem0): metadata I/O error in \u0026quot;xfs_da_read_buf+0x104/0x190\u0026quot; at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction.  This eliminates the window where\nthe parent holds a pointer to a cancelled block.  Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases.  First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction.  The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation.(CVE-2026-43053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcm_loop: Drain commands in target_reset handler\n\ntcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS\nwithout draining any in-flight commands.  The SCSI EH documentation\n(scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver\nhas made lower layers \u0026quot;forget about timed out scmds\u0026quot; and is ready for new\ncommands.  Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug,\nmpi3mr) enforces this by draining or completing outstanding commands before\nreturning SUCCESS.\n\nBecause tcm_loop_target_reset() doesn\u0026apos;t drain, the SCSI EH reuses in-flight\nscsi_cmnd structures for recovery commands (e.g. TUR) while the target core\nstill has async completion work queued for the old se_cmd.  The memset in\nqueuecommand zeroes se_lun and lun_ref_active, causing\ntransport_lun_remove_cmd() to skip its percpu_ref_put().  The leaked LUN\nreference prevents transport_clear_lun_ref() from completing, hanging\nconfigfs LUN unlink forever in D-state:\n\n  INFO: task rm:264 blocked for more than 122 seconds.\n  rm              D    0   264    258 0x00004000\n  Call Trace:\n   __schedule+0x3d0/0x8e0\n   schedule+0x36/0xf0\n   transport_clear_lun_ref+0x78/0x90 [target_core_mod]\n   core_tpg_remove_lun+0x28/0xb0 [target_core_mod]\n   target_fabric_port_unlink+0x50/0x60 [target_core_mod]\n   configfs_unlink+0x156/0x1f0 [configfs]\n   vfs_unlink+0x109/0x290\n   do_unlinkat+0x1d5/0x2d0\n\nFix this by making tcm_loop_target_reset() actually drain commands:\n\n 1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that\n    the target core knows about (those not yet CMD_T_COMPLETE).\n\n 2. Use blk_mq_tagset_busy_iter() to iterate all started requests and\n    flush_work() on each se_cmd — this drains any deferred completion work\n    for commands that already had CMD_T_COMPLETE set before the TMR (which\n    the TMR skips via __target_check_io_state()).  This is the same pattern\n    used by mpi3mr, scsi_debug, and libsas to drain outstanding commands\n    during reset.(CVE-2026-43054)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\n\nNETIF_F_IPV6_CSUM only advertises support for checksum offload of\npackets without IPv6 extension headers. Packets with extension\nheaders must fall back onto software checksumming. Since TSO\ndepends on checksum offload, those must revert to GSO.\n\nThe below commit introduces that fallback. It always checks\nnetwork header length. For tunneled packets, the inner header length\nmust be checked instead. Extend the check accordingly.\n\nA special case is tunneled packets without inner IP protocol. Such as\nRFC 6951 SCTP in UDP. Those are not standard IPv6 followed by\ntransport header either, so also must revert to the software GSO path.(CVE-2026-43057)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: annotate data-races around hdev-\u0026gt;req_status\n\n__hci_cmd_sync_sk() sets hdev-\u0026gt;req_status under hdev-\u0026gt;req_lock:\n\n    hdev-\u0026gt;req_status = HCI_REQ_PEND;\n\nHowever, several other functions read or write hdev-\u0026gt;req_status without\nholding any lock:\n\n  - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\n  - hci_cmd_sync_complete() reads/writes from HCI event completion\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\n  - hci_abort_conn() reads in connection abort path\n\nSince __hci_cmd_sync_sk() runs on hdev-\u0026gt;req_workqueue while\nhci_send_cmd_sync() runs on hdev-\u0026gt;workqueue, these are different\nworkqueues that can execute concurrently on different CPUs. The plain\nC accesses constitute a data race.\n\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\nto hdev-\u0026gt;req_status to prevent potential compiler optimizations that\ncould affect correctness (e.g., load fusing in the wait_event\ncondition or store reordering).(CVE-2026-43119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: check return value of con2fb_acquire_newinfo()\n\nIf fbcon_open() fails when called from con2fb_acquire_newinfo() then\ninfo-\u0026gt;fbcon_par pointer remains NULL which is later dereferenced.\n\nAdd check for return value of the function con2fb_acquire_newinfo() to\navoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2026-43123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ\n\nThis adds a check for encryption key size upon receiving\nL2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which\nexpects L2CAP_CR_LE_BAD_KEY_SIZE.(CVE-2026-43134)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\u0026quot;\n\nThis reverts commit 05703271c3cd (\u0026quot;PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\u0026quot;), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n  $ echo \u0026lt;NUM\u0026gt; \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/sriov_numvfs\n  $ echo 1 \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n  zsh/5715 is trying to acquire lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n  but task is already holding lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n  ...\n  Call Trace:\n   [\u0026lt;00000259778c4f90\u0026gt;] dump_stack_lvl+0xc0/0x110\n   [\u0026lt;00000259779c844e\u0026gt;] print_deadlock_bug+0x31e/0x330\n   [\u0026lt;00000259779c1908\u0026gt;] __lock_acquire+0x16c8/0x32f0\n   [\u0026lt;00000259779bffac\u0026gt;] lock_acquire+0x14c/0x350\n   [\u0026lt;00000259789643a6\u0026gt;] __mutex_lock_common+0xe6/0x1520\n   [\u0026lt;000002597896413c\u0026gt;] mutex_lock_nested+0x3c/0x50\n   [\u0026lt;00000259784a07e4\u0026gt;] sriov_disable+0x34/0x140\n   [\u0026lt;00000258f7d6dd80\u0026gt;] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n   [\u0026lt;00000258f7d5745e\u0026gt;] remove_one+0x5e/0xf0 [mlx5_core]\n   [\u0026lt;00000259784857fc\u0026gt;] pci_device_remove+0x3c/0xa0\n   [\u0026lt;000002597851012e\u0026gt;] device_release_driver_internal+0x18e/0x280\n   [\u0026lt;000002597847ae22\u0026gt;] pci_stop_bus_device+0x82/0xa0\n   [\u0026lt;000002597847afce\u0026gt;] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n   [\u0026lt;00000259784972c2\u0026gt;] remove_store+0x72/0x90\n   [\u0026lt;0000025977e6661a\u0026gt;] kernfs_fop_write_iter+0x15a/0x200\n   [\u0026lt;0000025977d7241c\u0026gt;] vfs_write+0x24c/0x300\n   [\u0026lt;0000025977d72696\u0026gt;] ksys_write+0x86/0x110\n   [\u0026lt;000002597895b61c\u0026gt;] __do_syscall+0x14c/0x400\n   [\u0026lt;000002597896e0ee\u0026gt;] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on.(CVE-2026-43147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Move vbus draw to workqueue context\n\nCurrently dwc3_gadget_vbus_draw() can be called from atomic\ncontext, which in turn invokes power-supply-core APIs. And\nsome these PMIC APIs have operations that may sleep, leading\nto kernel panic.\n\nFix this by moving the vbus_draw into a workqueue context.(CVE-2026-43170)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOMEM), it returns immediately without\nwaiting for the write URB to complete. Since the driver reuses the same\nURB structure, a subsequent call to pvr2_send_request_ex() attempts to\nsubmit the still-active write URB, triggering a \u0026apos;URB submitted while\nactive\u0026apos; warning in usb_submit_urb().\n\nFix this by ensuring the write URB is unlinked and waited upon if the read\nURB submission fails.(CVE-2026-43223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: Add support for TSV110 Spectre-BHB mitigation\n\nThe TSV110 processor is vulnerable to the Spectre-BHB (Branch History\nBuffer) attack, which can be exploited to leak information through\nbranch prediction side channels. This commit adds the MIDR of TSV110\nto the list for software mitigation.(CVE-2026-43261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nkexec: derive purgatory entry from symbol\n\nkexec_load_purgatory() derives image-\u0026gt;start by locating e_entry inside an\nSHF_EXECINSTR section.  If the purgatory object contains multiple\nexecutable sections with overlapping sh_addr, the entrypoint check can\nmatch more than once and trigger a WARN.\n\nDerive the entry section from the purgatory_start symbol when present and\ncompute image-\u0026gt;start from its final placement.  Keep the existing e_entry\nfallback for purgatories that do not expose the symbol.\n\nWARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784\nCall Trace:\n \u0026lt;TASK\u0026gt;\n bzImage64_load+0x133/0xa00\n __do_sys_kexec_file_load+0x2b3/0x5c0\n do_syscall_64+0x81/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n[(CVE-2026-43289)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix die ID init and look up bugs\n\nIn snbep_pci2phy_map_init(), in the nr_node_ids \u0026gt; 8 path,\nuncore_device_to_die() may return -1 when all CPUs associated\nwith the UBOX device are offline.\n\nRemove the WARN_ON_ONCE(die_id == -1) check for two reasons:\n\n- The current code breaks out of the loop. This is incorrect because\n  pci_get_device() does not guarantee iteration in domain or bus order,\n  so additional UBOX devices may be skipped during the scan.\n\n- Returning -EINVAL is incorrect, since marking offline buses with\n  die_id == -1 is expected and should not be treated as an error.\n\nSeparately, when NUMA is disabled on a NUMA-capable platform,\npcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die()\nto return -1 for all PCI devices.  As a result,\nspr_update_device_location(), used on Intel SPR and EMR, ignores the\ncorresponding PMON units and does not add them to the RB tree.\n\nFix this by using uncore_pcibus_to_dieid(), which retrieves topology\nfrom the UBOX GIDNIDMAP register and works regardless of whether NUMA\nis enabled in Linux.  This requires snbep_pci2phy_map_init() to be\nadded in spr_uncore_pci_init().\n\nKeep uncore_device_to_die() only for the nr_node_ids \u0026gt; 8 case, where\nNUMA is expected to be enabled.(CVE-2026-43344)\n\nThe Linux kernel Nouveau graphics driver has a race condition/null pointer dereference issue in DPCD (DisplayPort Configuration Data) AUX channel transmission processing. When the GPU device enters the suspend state due to runtime power management (runtime PM), if the user space program (such as through the /dev/drm_dp_ interface) attempts to initiate an AUX transfer request, the driver will try to access the GSP (Graphics System Processor) firmware code of the suspended device, causing the kernel to crash.(CVE-2026-43381)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: add a bunch of missing ceph_path_info initializers\n\nceph_mdsc_build_path() must be called with a zero-initialized\nceph_path_info parameter, or else the following\nceph_mdsc_free_path_info() may crash.\n\nExample crash (on Linux 6.18.12):\n\n  virt_to_cache: Object is not a Slab page!\n  WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400\n  [...]\n  Call Trace:\n   [...]\n   ceph_open+0x13d/0x3e0\n   do_dentry_open+0x134/0x480\n   vfs_open+0x2a/0xe0\n   path_openat+0x9a3/0x1160\n  [...]\n  cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info\n  WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400\n  [...]\n  kernel BUG at mm/slub.c:634!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  RIP: 0010:__slab_free+0x1a4/0x350\n\nSome of the ceph_mdsc_build_path() callers had initializers, but\nothers had not, even though they were all added by commit 15f519e9f883\n(\u0026quot;ceph: fix race condition validating r_parent before applying state\u0026quot;).\nThe ones without initializer are suspectible to random crashes.  (I can\nimagine it could even be possible to exploit this bug to elevate\nprivileges.)\n\nUnfortunately, these Ceph functions are undocumented and its semantics\ncan only be derived from the code.  I see that ceph_mdsc_build_path()\ninitializes the structure only on success, but not on error.\n\nCalling ceph_mdsc_free_path_info() after a failed\nceph_mdsc_build_path() call does not even make sense, but that\u0026apos;s what\nall callers do, and for it to be safe, the structure must be\nzero-initialized.  The least intrusive approach to fix this is\ntherefore to add initializers everywhere.(CVE-2026-43408)\n\nIn the Linux kernel, the following vulnerability has been resolved: powerpc, perf: Check that current-\u0026gt;mm is alive before getting user callchain. It may happen that mm is already released, which leads to kernel panic. This adds the NULL check for current-\u0026gt;mm, similarly to commit 20afc60f892d (\u0026quot;x86, perf: Check that current-\u0026gt;mm is alive before getting user callchain\u0026quot;). I was getting this panic when running a profiling BPF program (profile.py from bcc-tools). In addition, move storing the top-level stack entry to generic perf_callchain_user to make sure the top-level entry is always captured, even if current-\u0026gt;mm is NULL.(CVE-2026-43416)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u0026gt;length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.(CVE-2026-43427)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don\u0026apos;t return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don\u0026apos;t attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.(CVE-2026-43470)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nunshare: fix unshare_fs() handling\n\nThere\u0026apos;s an unpleasant corner case in unshare(2), when we have a\nCLONE_NEWNS in flags and current-\u0026gt;fs hadn\u0026apos;t been shared at all; in that\ncase copy_mnt_ns() gets passed current-\u0026gt;fs instead of a private copy,\nwhich causes interesting warts in proof of correctness]\n\n\u0026gt; I guess if private means fs-\u0026gt;users == 1, the condition could still be true.\n\nUnfortunately, it\u0026apos;s worse than just a convoluted proof of correctness.\nConsider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS\n(and current-\u0026gt;fs-\u0026gt;users == 1).\n\nWe pass current-\u0026gt;fs to copy_mnt_ns(), all right.  Suppose it succeeds and\nflips current-\u0026gt;fs-\u0026gt;{pwd,root} to corresponding locations in the new namespace.\nNow we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).\nWe call put_mnt_ns() on the namespace created by copy_mnt_ns(), it\u0026apos;s\ndestroyed and its mount tree is dissolved, but...  current-\u0026gt;fs-\u0026gt;root and\ncurrent-\u0026gt;fs-\u0026gt;pwd are both left pointing to now detached mounts.\n\nThey are pinning those, so it\u0026apos;s not a UAF, but it leaves the calling\nprocess with unshare(2) failing with -ENOMEM _and_ leaving it with\npwd and root on detached isolated mounts.  The last part is clearly a bug.\n\nThere is other fun related to that mess (races with pivot_root(), including\nthe one between pivot_root() and fork(), of all things), but this one\nis easy to isolate and fix - treat CLONE_NEWNS as \u0026quot;allocate a new\nfs_struct even if it hadn\u0026apos;t been shared in the first place\u0026quot;.  Sure, we could\ngo for something like \u0026quot;if both CLONE_NEWNS *and* one of the things that might\nend up failing after copy_mnt_ns() call in create_new_namespaces() are set,\nforce allocation of new fs_struct\u0026quot;, but let\u0026apos;s keep it simple - the cost\nof copy_fs_struct() is trivial.\n\nAnother benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets\na freshly allocated fs_struct, yet to be attached to anything.  That\nseriously simplifies the analysis...\n\nFWIW, that bug had been there since the introduction of unshare(2) ;-/(CVE-2026-43472)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated\n\nExplicitly set/clear CR8 write interception when AVIC is (de)activated to\nfix a bug where KVM leaves the interception enabled after AVIC is\nactivated.  E.g. if KVM emulates INIT=\u0026gt;WFS while AVIC is deactivated, CR8\nwill remain intercepted in perpetuity.\n\nOn its own, the dangling CR8 intercept is \u0026quot;just\u0026quot; a performance issue, but\ncombined with the TPR sync bug fixed by commit d02e48830e3f (\u0026quot;KVM: SVM:\nSync TPR from LAPIC into VMCB::V_TPR even if AVIC is active\u0026quot;), the danging\nintercept is fatal to Windows guests as the TPR seen by hardware gets\nwildly out of sync with reality.\n\nNote, VMX isn\u0026apos;t affected by the bug as TPR_THRESHOLD is explicitly ignored\nwhen Virtual Interrupt Delivery is enabled, i.e. when APICv is active in\nKVM\u0026apos;s world.  I.e. there\u0026apos;s no need to trigger update_cr8_intercept(), this\nis firmly an SVM implementation flaw/detail.\n\nWARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should\nnever enter the guest with AVIC enabled and CR8 writes intercepted.\n\n[Squash fix to avic_deactivate_vmcb. - Paolo](CVE-2026-43483)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()\n\nYiming reports an integer underflow in mpi_read_raw_from_sgl() when\nsubtracting \u0026quot;lzeros\u0026quot; from the unsigned \u0026quot;nbytes\u0026quot;.\n\nFor this to happen, the scatterlist \u0026quot;sgl\u0026quot; needs to occupy more bytes\nthan the \u0026quot;nbytes\u0026quot; parameter and the first \u0026quot;nbytes + 1\u0026quot; bytes of the\nscatterlist must be zero.  Under these conditions, the while loop\niterating over the scatterlist will count more zeroes than \u0026quot;nbytes\u0026quot;,\nsubtract the number of zeroes from \u0026quot;nbytes\u0026quot; and cause the underflow.\n\nWhen commit 2d4d1eea540b (\u0026quot;lib/mpi: Add mpi sgl helpers\u0026quot;) originally\nintroduced the bug, it couldn\u0026apos;t be triggered because all callers of\nmpi_read_raw_from_sgl() passed a scatterlist whose length was equal to\n\u0026quot;nbytes\u0026quot;.\n\nHowever since commit 63ba4d67594a (\u0026quot;KEYS: asymmetric: Use new crypto\ninterface without scatterlists\u0026quot;), the underflow can now actually be\ntriggered.  When invoking a KEYCTL_PKEY_ENCRYPT system call with a\nlarger \u0026quot;out_len\u0026quot; than \u0026quot;in_len\u0026quot; and filling the \u0026quot;in\u0026quot; buffer with zeroes,\ncrypto_akcipher_sync_prep() will create an all-zero scatterlist used for\nboth the \u0026quot;src\u0026quot; and \u0026quot;dst\u0026quot; member of struct akcipher_request and thereby\nfulfil the conditions to trigger the bug:\n\n  sys_keyctl()\n    keyctl_pkey_e_d_s()\n      asymmetric_key_eds_op()\n        software_key_eds_op()\n          crypto_akcipher_sync_encrypt()\n            crypto_akcipher_sync_prep()\n              crypto_akcipher_encrypt()\n                rsa_enc()\n                  mpi_read_raw_from_sgl()\n\nTo the user this will be visible as a DoS as the kernel spins forever,\ncausing soft lockup splats as a side effect.\n\nFix it.(CVE-2026-43492)","status":"published","published":"2026-05-29T11:11:26Z","modified":"2026-08-18T01:20:01.365144884Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-43470","description":"In the Linux kernel, the following vulnerability has been resolved: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.","status":"published","published":"2026-05-08T15:17:00Z","modified":"2026-11-11T09:39:48.520725797Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T10:01:46.695102Z"},{"id":"CVE-2026-43470","title":"nfs: return EISDIR on nfs3_proc_create if d_alias is a dir","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don't return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don't attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops.","status":"published","published":"2026-05-08T14:22:30.218Z","modified":"2026-10-28T02:30:47.269426129Z","updated_at":"2026-11-02T15:45:04.479642Z"},{"id":"openSUSE-SU-2026:21388-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:32Z","modified":"2026-07-24T18:24:22.02722596Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22108-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n\nThe following non-security bugs were fixed:\n\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-15T18:32:29Z","modified":"2026-06-17T09:15:06.724017524Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22137-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n\nThe following non-security bugs were fixed:\n\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-15T17:11:08Z","modified":"2026-06-18T18:24:22.740905876Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22433-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Improve compatibility with awk 2.4.0 (bsc#1266214). \n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- wicked test: Added missing locking in backport (bsc#1267732).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T17:41:36Z","modified":"2026-07-03T18:24:21.036345246Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22458-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Improve compatibility with awk 2.4.0 (bsc#1266214). \n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- wicked test: Added missing locking in backport (bsc#1267732).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","status":"published","published":"2026-06-30T11:07:10Z","modified":"2026-07-04T18:24:20.416361045Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22742-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-23T18:24:18.071402846Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22769-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-23T18:24:21.24177443Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22812-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:33Z","modified":"2026-07-28T18:24:06.778434145Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22835-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).\n- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit\n  in br_nf_local_in() after confirm (bsc#1262430).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).\n- CVE-2026-23394: Revert: \"af_unix: Remove lock dance in unix_peek_fds().\" (bsc#1260565).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready() (bsc#1264007).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to\n  initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).\n- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).\n- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).\n- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).\n- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).\n- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43199: net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query (bsc#1264556).\n- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).\n- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).\n- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).\n- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).\n- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).\n- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).\n- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).\n- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).\n- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).\n- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).\n- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).\n- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).\n- CVE-2026-43458: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release (bsc#1265005).\n- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).\n- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).\n- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq (bsc#1264978).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).\n- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).\n- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).\n- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).\n- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).\n- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).\n- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails (bsc#1266740).\n- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).\n- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).\n- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).\n- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).\n- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).\n- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator (bsc#1269234).\n- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).\n- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).\n- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).\n- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).\n- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).\n- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).\n- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).\n- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).\n- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).\n- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).\n- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).\n- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).\n- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).\n- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).\n- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).\n- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).\n- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).\n- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).\n- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).\n- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).\n- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).\n- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).\n- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53272: erofs: fix use-after-free on sbi-\u003esync_decompress (bsc#1269809).\n- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).\n- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).\n- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: timer: Forcibly close timer instances at closing (git-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: virtio: Validate control metadata from the device (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).\n- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).\n- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).\n- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).\n- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).\n- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).\n- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).\n- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).\n- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).\n- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).\n- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).\n- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).\n- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- crypto: tegra - Fix dma_free_coherent size error (git-fixes).\n- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).\n- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).\n- fbdev: fix use-after-free in store_modes() (stable-fixes).\n- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).\n- ftrace: Do not over-allocate ftrace memory (bsc#1267600).\n- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).\n- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).\n- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpio: mxc: fix irq_high handling (git-fixes).\n- gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled() (git-fixes).\n- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).\n- gpio: zynq: fix runtime PM leak on remove (git-fixes).\n- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).\n- gpiolib: Remove redundant assignment of return variable (stable-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).\n- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).\n- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).\n- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).\n- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).\n- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).\n- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).\n- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).\n- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: disable runtime PM on adapter registration failure (git-fixes).\n- i2c: core: fix adapter debugfs creation (git-fixes).\n- i2c: core: fix adapter deregistration race (git-fixes).\n- i2c: core: fix adapter probe deferral loop (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix hang on adapter registration failure (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: backend: fix uninitialized data in debugfs (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: xpad - add \"Nova 2 Lite\" from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).\n- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).\n- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).\n- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).\n- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).\n- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).\n- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).\n- ipv4: account for fraggap on the paged allocation path (git-fixes).\n- ipv6: account for fraggap on the paged allocation path (git-fixes).\n- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).\n- KEYS: Use acquire when reading state in keyring search (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).\n- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).\n- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).\n- KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata (git-fixes).\n- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).\n- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).\n- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).\n- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).\n- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).\n- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).\n- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).\n- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).\n- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).\n- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).\n- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).\n- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).\n- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Sync page pool RX frags for CPU (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- net: mana: Validate the packet length reported by the NIC (git-fixes).\n- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).\n- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).\n- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).\n- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- packaging: Add nvidia kernel description.\n- packaging: compute-PATCHVERSION.sh -\u003e compute-PATCHVERSION.\n- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- PCI: Update saved_config_space upon resource assignment (git-fixes).\n- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).\n- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).\n- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).\n- pwm: imx27: Fix variable truncation in .apply() (git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).\n- Revert \"fs: don't block i_writecount during exec\" (bsc#1269982).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).\n- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).\n- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).\n- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).\n- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).\n- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).\n- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).\n- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).\n- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).\n- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).\n- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).\n- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).\n- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).\n- scripts/sorttable: Remove unused macro defines (bsc#1267600).\n- scripts/sorttable: Remove unused write functions (bsc#1267600).\n- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).\n- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).\n- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).\n- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).\n- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).\n- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).\n- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).\n- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).\n- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).\n- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).\n- selftests/bpf: Fix runqslower cross-endian build (poo#202224).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).\n- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).\n- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).\n- selftests/bpf: Skip tests whose objects were not built (poo#202224).\n- selftests/bpf: Support cross-endian building (poo#202224).\n- selftests/bpf: Tolerate benchmark build failures (poo#202224).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).\n- selftests/bpf: Tolerate missing files during install (poo#202224).\n- selftests/bpf: Tolerate test file compilation failures (poo#202224).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock (git-fixes).\n- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).\n- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).\n- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).\n- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).\n- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).\n- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thermal: testing: reject missing command arguments (git-fixes).\n- thermal: testing: zone: Flush work items during cleanup (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).\n- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).\n- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).\n- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).\n- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).\n- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).\n- x86/cpu: Disable FRED when PTI is forced on (git-fixes).\n- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).\n- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).\n- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).\n","status":"published","published":"2026-07-21T08:27:34Z","modified":"2026-07-28T18:24:09.217846062Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2482-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n  (bsc#1260548).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n  leak (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43150: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- cgroup: Increment nr_dying_subsys_* from rmdir context (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: process XSK TX descriptors as part of RX NAPI (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261591).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/mm: Add missing secure storage access fixups for donated memory (bsc#1264835).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1261591).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-22T11:10:39Z","modified":"2026-06-24T09:00:12.545896102Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2591-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n  (bsc#1260548).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n  leak (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43150: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- cgroup: Increment nr_dying_subsys_* from rmdir context (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: process XSK TX descriptors as part of RX NAPI (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261591).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/mm: Add missing secure storage access fixups for donated memory (bsc#1264835).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1261591).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-23T14:31:51Z","modified":"2026-06-24T09:00:17.492290835Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}