{"id":"CVE-2026-74609","aliases":["AZL-97062","BELL-CVE-2026-74609","CLSA-2026-1789141176","CLSA-2026-1789898700","CLSA-2026-1789958474","CLSA-2026-1791800936","CLSA-2026-1791876326","CLSA-2026-1791878869","CLSA-2026-1791946572","CLSA-2026-1792243729","CLSA-2026-1792247642","DEBIAN-CVE-2026-74609","EUVD-2026-64546","GHSA-c6xm-fh9c-399h","MGASA-2026-0506","MGASA-2026-0542","OESA-2026-3707","OESA-2026-3708","OESA-2026-4357","SUSE-SU-2026:24179-1","SUSE-SU-2026:24181-1","SUSE-SU-2026:24182-1","SUSE-SU-2026:24184-1","SUSE-SU-2026:24197-1","SUSE-SU-2026:24235-1","SUSE-SU-2026:24315-1","SUSE-SU-2026:24316-1","SUSE-SU-2026:4640-1","SUSE-SU-2026:4660-1","SUSE-SU-2026:4665-1","SUSE-SU-2026:4666-1","SUSE-SU-2026:4667-1","SUSE-SU-2026:4668-1","SUSE-SU-2026:4687-1","SUSE-SU-2026:4706-1","UBUNTU-CVE-2026-74609","USN-8875-1","USN-8875-2","USN-8877-1","USN-8878-1","USN-8879-1","USN-8886-1","USN-8959-1","USN-8960-1","USN-8963-1","openSUSE-SU-2026:22091-1"],"status":"published","title":"tipc: read le-\u003elink under the node lock in tipc_node_link_down()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00126,"percentile":0.02269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-22T15:31:56Z","modified":"2026-11-10T02:51:30Z","fixes":[{"ecosystem":"Azure Linux:3","package":"kernel","fixed_in":["6.6.152.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.189-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.111-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.46-r0"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["5.10.265","5.15.216","6.1.183","6.6.152","6.12.104","6.18.45","7.1.9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.187-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.105-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["7.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux-6.12","fixed_in":["6.12.107-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws-5.15","fixed_in":["5.15.0-1117.124~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-5.15","fixed_in":["5.15.0-1123.132~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","fixed_in":["5.15.0-1122.131~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp-5.15","fixed_in":["5.15.0-1118.128~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-hwe-5.15","fixed_in":["5.15.0-198.208~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm-5.15","fixed_in":["5.15.0-1111.115~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-intel-iotg-5.15","fixed_in":["5.15.0-1112.118~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-lowlatency-hwe-5.15","fixed_in":["5.15.0-195.205~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-nvidia-tegra-5.15","fixed_in":["5.15.0-1070.72~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle-5.15","fixed_in":["5.15.0-1114.120~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-riscv-5.15","fixed_in":["5.15.0-1111.115~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux","fixed_in":["5.15.0-198.208"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","fixed_in":["5.15.0-1117.124"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","fixed_in":["5.15.0-1123.132"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","fixed_in":["5.15.0-1122.131"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","fixed_in":["5.15.0-1118.128"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","fixed_in":["5.15.0-1113.119"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","fixed_in":["5.15.0-1100.108"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","fixed_in":["5.15.0-1111.115"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","fixed_in":["5.15.0-1112.118"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","fixed_in":["5.15.0-1109.114"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","fixed_in":["5.15.0-195.205"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","fixed_in":["5.15.0-1112.113"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","fixed_in":["5.15.0-1070.72"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","fixed_in":["5.15.0-1059.59"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","fixed_in":["5.15.0-1114.120"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","fixed_in":["5.15.0-1080.84"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","fixed_in":["5.15.0-1101.103"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","fixed_in":["5.15.0-1109.111"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","fixed_in":["5.15.0-1116.125"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","fixed_in":["5.15.0-1117.124+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","fixed_in":["5.15.0-1123.132+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","fixed_in":["5.15.0-198.208+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","fixed_in":["5.15.0-1118.128+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-7.0","fixed_in":["7.0.0-42.42~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1036.39"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-7.0","fixed_in":["7.0.0-42.42.1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux","fixed_in":["7.0.0-42.42"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-aws","fixed_in":["7.0.0-1016.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-gcp","fixed_in":["7.0.0-1016.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-ibm","fixed_in":["7.0.0-1017.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-oem-7.0","fixed_in":["7.0.0-1017.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-oracle","fixed_in":["7.0.0-1015.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-riscv","fixed_in":["7.0.0-42.42.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.152.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.182-r0"},{"fixed":"6.1.189-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.103-r0"},{"fixed":"6.12.111-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.43-r0"},{"fixed":"6.18.46-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-553.6.1.el8_10.tuxcare.els30"}]}],"bundled":129},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els14"}]}],"bundled":170},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-buildinfo-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-buildinfo-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-cloud-tools-5.4.0-238","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-cloud-tools-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-cloud-tools-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-headers-5.4.0-238","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-headers-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-headers-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-image-unsigned-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-image-unsigned-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-modules-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-modules-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-modules-extra-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-source-5.4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-tools-5.4.0-238","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-tools-5.4.0-238-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-tools-5.4.0-238-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-238.258+tuxcare.els1"}]}],"bundled":165},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els15"}]}],"bundled":197},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-extra-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-source-4.15.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-hwe-cloud-tools-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-hwe-tools-4.15.0-266","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-extra-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source-4.15.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.15.0-266-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.15.0-266-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-266.277~16.04.1+tuxcare.els1"}]}],"bundled":277},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-288","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-288","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-extra-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source-4.4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-288","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-288-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-288-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-288.322+tuxcare.els1"}]}],"bundled":198},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-305.25.1.el8_4.tuxcare.els49"}]}],"bundled":53},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-348.7.1.el8_5.tuxcare.els49"}]}],"bundled":49},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.152"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.104"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.45"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.187-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.176-1","6.1.177-1","6.1.180-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.105-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.9-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.113-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1","7.0-1~exp1","7.0.1-1~exp1","7.0.10-1","7.0.10-1~bpo13+1","7.0.12-1","7.0.12-2","7.0.12-2~bpo13+1","7.0.13-1","7.0.13-1~bpo13+1","7.0.14-1","7.0.3-1","7.0.4-1","7.0.4-1~bpo13+1","7.0.7-1","7.0.7-1~bpo13+1","7.0.9-1","7.0.9-1~bpo13+1","7.1.1-1~exp1","7.1.2-1~exp1","7.1.3-1","7.1.3-1+sunvdc","7.1.3-1~bpo13+1","7.1.4-1","7.1.5-1","7.1.6-1","7.1.7-1","7.1.7-1~bpo13+1","7.1.8-1","7.1.8-1~bpo13+1","7.1.8-2","7.1~rc2-1~exp1","7.1~rc3-1~exp1","7.1~rc4-1~exp1","7.1~rc4-1~exp2","7.1~rc5-1~exp1","7.1~rc7-1~exp1"]},{"source":"osv","ecosystem":"Debian:12","package":"linux-6.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.107-1~deb12u1"}]}],"versions":["6.12.100-1~deb12u1","6.12.101-1~deb12u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.18.55-1.mga10"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30-5.mga10"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-31.mga10"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"drakx-installer-images","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.94-56.mga10"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"drakx-installer-images","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.94-56.mga10.nonfree"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"kmod-nvidia-current-wopengpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"580.173.02-40.mga10.nonfree"}]}],"bundled":1146},{"source":"osv","ecosystem":"Mageia:10","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.18.55-1.mga10"}]}],"bundled":1146},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.1.25.162.oe2403sp1"}]}],"bundled":111},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.3.30.161.20260910.f620d9c7c985.oe2403sp3"}]}],"bundled":80},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-337.0.0.238.oe2203sp4"}]}],"bundled":67},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1.159998.21.38"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-160000.6.1"}]}],"bundled":479},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":479},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":479},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1.159998.21.38"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":473},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":479},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-159998.53.1"}]}],"bundled":479},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.78.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.78.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.78.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1.150600.12.64.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1.150600.12.64.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.138.1"}]}],"bundled":124},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.164.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.164.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.189.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.189.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.189.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.189.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2.150500.6.89.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_46","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2.150500.6.89.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2.150500.6.89.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2.150500.6.89.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2.150500.6.89.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.2"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.192.1"}]}],"bundled":110},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-livepatch-SLE15-SP4_Update_60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150400.9.3.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1.150400.24.122.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.243.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_88","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.3.3"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.333.2"}]}],"bundled":229},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1.150700.17.47.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.84.1"}]}],"bundled":508},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1002.2","4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1011.11","4.4.0-1012.12","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1017.17","4.4.0-1019.19","4.4.0-1022.22","4.4.0-1023.23","4.4.0-1024.25","4.4.0-1025.26","4.4.0-1027.30","4.4.0-1028.31","4.4.0-1029.32","4.4.0-1031.34","4.4.0-1032.35","4.4.0-1034.37","4.4.0-1036.39","4.4.0-1037.40","4.4.0-1038.41","4.4.0-1039.42","4.4.0-1040.43","4.4.0-1042.45","4.4.0-1044.47","4.4.0-1045.48","4.4.0-1046.50","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1052.56","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1056.60","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1060.64","4.4.0-1061.65","4.4.0-1062.66","4.4.0-1064.68","4.4.0-1065.69","4.4.0-1066.70","4.4.0-1067.71","4.4.0-1073.77","4.4.0-1074.78","4.4.0-1075.79","4.4.0-1076.80","4.4.0-1077.81","4.4.0-1078.82","4.4.0-1081.85","4.4.0-1082.86","4.4.0-1083.87","4.4.0-1085.89","4.4.0-1086.90","4.4.0-1087.91","4.4.0-1088.92","4.4.0-1090.94","4.4.0-1091.95","4.4.0-1092.96","4.4.0-1093.97","4.4.0-1094.99","4.4.0-1095.100","4.4.0-1096.101","4.4.0-1097.102","4.4.0-1098.103","4.4.0-1099.104","4.4.0-1101.106","4.4.0-1102.107","4.4.0-1103.108","4.4.0-1104.109","4.4.0-1107.113","4.4.0-1109.115","4.4.0-1110.116","4.4.0-1111.117","4.4.0-1112.118","4.4.0-1113.119","4.4.0-1114.120","4.4.0-1115.121","4.4.0-1116.122","4.4.0-1117.123","4.4.0-1118.124","4.4.0-1119.125","4.4.0-1120.126","4.4.0-1121.127","4.4.0-1122.128","4.4.0-1123.129","4.4.0-1124.130","4.4.0-1125.131","4.4.0-1127.133","4.4.0-1128.134","4.4.0-1129.135","4.4.0-1130.136","4.4.0-1131.137","4.4.0-1133.139","4.4.0-1134.140","4.4.0-1135.141","4.4.0-1136.142","4.4.0-1137.143","4.4.0-1138.144","4.4.0-1139.145","4.4.0-1140.146","4.4.0-1141.147","4.4.0-1142.148","4.4.0-1143.149","4.4.0-1144.150","4.4.0-1145.151","4.4.0-1146.152","4.4.0-1147.153","4.4.0-1148.154","4.4.0-1149.155","4.4.0-1150.156","4.4.0-1151.157","4.4.0-1152.158","4.4.0-1153.159","4.4.0-1154.160","4.4.0-1155.161","4.4.0-1156.162","4.4.0-1157.163","4.4.0-1158.164","4.4.0-1159.165","4.4.0-1160.166","4.4.0-1161.167","4.4.0-1162.168"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1","4.15.0-1031.32~14.04.1","4.15.0-1032.33~14.04.2","4.15.0-1035.36~14.04.2","4.15.0-1036.38~14.04.2","4.15.0-1037.39~14.04.2","4.15.0-1039.41~14.04.2","4.15.0-1040.44~14.04.1","4.15.0-1041.45~14.04.1","4.15.0-1042.46~14.04.1","4.15.0-1045.49~14.04.1","4.15.0-1046.50~14.04.1","4.15.0-1047.51~14.04.1","4.15.0-1049.54~14.04.1","4.15.0-1050.55~14.04.1","4.15.0-1051.56~14.04.1","4.15.0-1052.57~14.04.1","4.15.0-1055.60~14.04.1","4.15.0-1056.61~14.04.1","4.15.0-1057.62~14.04.1","4.15.0-1059.64~14.04.1","4.15.0-1060.65~14.04.1","4.15.0-1061.66~14.04.1","4.15.0-1063.68~14.04.1","4.15.0-1064.69~14.04.1","4.15.0-1066.71~14.04.1","4.15.0-1067.72~14.04.1","4.15.0-1069.74~14.04.1","4.15.0-1071.76~14.04.1","4.15.0-1074.79~14.04.1","4.15.0-1077.82~14.04.1","4.15.0-1082.92~14.04.1","4.15.0-1083.93~14.04.1","4.15.0-1089.99~14.04.1","4.15.0-1091.101~14.04.1","4.15.0-1092.102~14.04.1","4.15.0-1093.103~14.04.1","4.15.0-1095.105~14.04.1","4.15.0-1096.106~14.04.1","4.15.0-1098.109~14.04.1","4.15.0-1100.111~14.04.1","4.15.0-1102.113~14.04.1","4.15.0-1103.114~14.04.1","4.15.0-1106.118~14.04.1","4.15.0-1108.120~14.04.1","4.15.0-1109.121~14.04.1","4.15.0-1110.122~14.04.1","4.15.0-1111.123~14.04.1","4.15.0-1112.124~14.04.1","4.15.0-1113.126~14.04.1","4.15.0-1114.127~14.04.1","4.15.0-1115.128~14.04.1","4.15.0-1118.131~14.04.1","4.15.0-1121.134~14.04.1","4.15.0-1122.135~14.04.1","4.15.0-1123.136~14.04.1","4.15.0-1124.137~14.04.1","4.15.0-1125.138~14.04.1","4.15.0-1126.139~14.04.1","4.15.0-1127.140~14.04.1","4.15.0-1129.142~14.04.1","4.15.0-1130.143~14.04.1","4.15.0-1131.144~14.04.1","4.15.0-1133.146~14.04.1","4.15.0-1134.147~14.04.1","4.15.0-1136.149~14.04.1","4.15.0-1137.150~14.04.1","4.15.0-1138.151~14.04.1","4.15.0-1139.152~14.04.1","4.15.0-1142.156~14.04.1","4.15.0-1145.160~14.04.1","4.15.0-1146.161~14.04.1","4.15.0-1149.164~14.04.1","4.15.0-1150.165~14.04.1","4.15.0-1151.166~14.04.1","4.15.0-1153.168~14.04.1","4.15.0-1157.172~14.04.2","4.15.0-1158.173~14.04.1","4.15.0-1159.174~14.04.1","4.15.0-1162.177~14.04.1","4.15.0-1163.178~14.04.1","4.15.0-1164.179~14.04.1","4.15.0-1165.180~14.04.1","4.15.0-1166.181~14.04.1","4.15.0-1167.182~14.04.1","4.15.0-1168.183~14.04.1","4.15.0-1169.184~14.04.1","4.15.0-1170.185~14.04.1","4.15.0-1171.186~14.04.1","4.15.0-1172.187~14.04.1","4.15.0-1173.188~14.04.1","4.15.0-1174.189~14.04.1","4.15.0-1175.190~14.04.1","4.15.0-1176.191~14.04.1","4.15.0-1177.192~14.04.1","4.15.0-1178.193~14.04.1","4.15.0-1179.194~14.04.1","4.15.0-1180.195~14.04.1","4.15.0-1181.196~14.04.1","4.15.0-1182.197~14.04.1","4.15.0-1183.198~14.04.1","4.15.0-1184.199~14.04.1","4.15.0-1185.200~14.04.1","4.15.0-1186.201~14.04.1","4.15.0-1187.202~14.04.1","4.15.0-1188.203~14.04.1","4.15.0-1189.204~14.04.1","4.15.0-1190.205~14.04.1","4.15.0-1191.206~14.04.1","4.15.0-1192.207~14.04.1","4.15.0-1193.208~14.04.1","4.15.0-1194.209~14.04.1","4.15.0-1195.210~14.04.1","4.15.0-1196.211~14.04.1","4.15.0-1197.212~14.04.1","4.15.0-1199.214~14.04.1","4.15.0-1200.215~14.04.1","4.15.0-1201.216~14.04.1","4.15.0-1202.217~14.04.1","4.15.0-1205.220~14.04.1","4.15.0-1206.221~14.04.1","4.15.0-1207.222~14.04.1","4.15.0-1208.223~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1","4.4.0-87.110~14.04.1","4.4.0-89.112~14.04.1","4.4.0-91.114~14.04.1","4.4.0-92.115~14.04.1","4.4.0-93.116~14.04.1","4.4.0-96.119~14.04.1","4.4.0-97.120~14.04.1","4.4.0-98.121~14.04.1","4.4.0-101.124~14.04.1","4.4.0-103.126~14.04.1","4.4.0-104.127~14.04.1","4.4.0-108.131~14.04.1","4.4.0-109.132~14.04.1","4.4.0-111.134~14.04.1","4.4.0-112.135~14.04.1","4.4.0-116.140~14.04.1","4.4.0-119.143~14.04.1","4.4.0-121.145~14.04.1","4.4.0-124.148~14.04.1","4.4.0-127.153~14.04.1","4.4.0-128.154~14.04.1","4.4.0-130.156~14.04.1","4.4.0-131.157~14.04.1","4.4.0-133.159~14.04.1","4.4.0-134.160~14.04.1","4.4.0-135.161~14.04.1","4.4.0-137.163~14.04.1","4.4.0-138.164~14.04.1","4.4.0-139.165~14.04.1","4.4.0-140.166~14.04.1","4.4.0-141.167~14.04.1","4.4.0-142.168~14.04.1","4.4.0-143.169~14.04.2","4.4.0-144.170~14.04.1","4.4.0-146.172~14.04.1","4.4.0-148.174~14.04.1","4.4.0-150.176~14.04.1","4.4.0-151.178~14.04.1","4.4.0-154.181~14.04.1","4.4.0-157.185~14.04.1","4.4.0-159.187~14.04.1","4.4.0-161.189~14.04.1","4.4.0-164.192~14.04.1","4.4.0-165.193~14.04.1","4.4.0-166.195~14.04.1","4.4.0-168.197~14.04.1","4.4.0-169.198~14.04.1","4.4.0-170.199~14.04.1","4.4.0-171.200~14.04.1","4.4.0-173.203~14.04.1","4.4.0-174.204~14.04.1","4.4.0-176.206~14.04.1","4.4.0-177.207~14.04.1","4.4.0-178.208~14.04.1","4.4.0-179.209~14.04.1","4.4.0-184.214~14.04.1","4.4.0-185.215~14.04.1","4.4.0-186.216~14.04.1","4.4.0-187.217~14.04.1","4.4.0-189.219~14.04.1","4.4.0-190.220~14.04.1","4.4.0-193.224~14.04.1","4.4.0-194.226~14.04.1","4.4.0-197.229~14.04.1","4.4.0-198.230~14.04.1","4.4.0-200.232~14.04.1","4.4.0-201.233~14.04.1","4.4.0-203.235~14.04.1","4.4.0-204.236~14.04.1","4.4.0-206.238~14.04.1","4.4.0-208.240~14.04.1","4.4.0-209.241~14.04.1","4.4.0-210.242~14.04.1","4.4.0-211.243~14.04.1","4.4.0-212.244~14.04.1","4.4.0-213.245~14.04.1","4.4.0-214.246~14.04.1","4.4.0-215.247~14.04.1","4.4.0-218.251~14.04.1","4.4.0-219.252~14.04.1","4.4.0-221.254~14.04.1","4.4.0-222.255~14.04.1","4.4.0-223.256~14.04.1","4.4.0-224.257~14.04.1","4.4.0-227.261~14.04.1","4.4.0-229.263~14.04.1","4.4.0-230.264~14.04.1","4.4.0-231.265~14.04.1","4.4.0-233.267~14.04.1","4.4.0-234.268~14.04.1","4.4.0-235.269~14.04.1","4.4.0-236.270~14.04.1","4.4.0-237.271~14.04.1","4.4.0-239.273~14.04.1","4.4.0-240.274~14.04.1","4.4.0-241.275~14.04.1","4.4.0-242.276~14.04.1","4.4.0-243.277~14.04.1","4.4.0-244.278~14.04.1","4.4.0-245.279~14.04.1","4.4.0-246.280~14.04.1","4.4.0-248.282~14.04.1","4.4.0-250.284~14.04.1","4.4.0-251.285~14.04.1","4.4.0-252.286~14.04.1","4.4.0-253.287~14.04.1","4.4.0-254.288~14.04.1","4.4.0-256.290~14.04.1","4.4.0-257.291~14.04.1","4.4.0-258.292~14.04.2","4.4.0-259.293~14.04.1","4.4.0-260.294~14.04.1","4.4.0-261.295~14.04.1","4.4.0-262.296~14.04.1","4.4.0-263.297~14.04.1","4.4.0-264.298~14.04.1","4.4.0-266.300~14.04.1","4.4.0-267.301~14.04.1","4.4.0-268.302~14.04.1","4.4.0-269.303~14.04.1","4.4.0-270.304~14.04.1","4.4.0-271.305~14.04.1","4.4.0-272.306~14.04.1","4.4.0-273.307~14.04.1","4.4.0-274.308~14.04.1","4.4.0-276.310~14.04.1","4.4.0-277.311~14.04.1","4.4.0-278.312~14.04.1","4.4.0-279.313~14.04.1","4.4.0-280.314~14.04.1","4.4.0-281.315~14.04.1","4.4.0-283.317~14.04.1","4.4.0-284.318~14.04.1","4.4.0-287.321~14.04.1","4.4.0-288.322~14.04.1","4.4.0-289.323~14.04.1","4.4.0-290.324~14.04.1","4.4.0-291.325~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106","4.4.0-87.110","4.4.0-89.112","4.4.0-91.114","4.4.0-92.115","4.4.0-93.116","4.4.0-96.119","4.4.0-97.120","4.4.0-98.121","4.4.0-101.124","4.4.0-103.126","4.4.0-104.127","4.4.0-108.131","4.4.0-109.132","4.4.0-112.135","4.4.0-116.140","4.4.0-119.143","4.4.0-121.145","4.4.0-122.146","4.4.0-124.148","4.4.0-127.153","4.4.0-128.154","4.4.0-130.156","4.4.0-131.157","4.4.0-133.159","4.4.0-134.160","4.4.0-135.161","4.4.0-137.163","4.4.0-138.164","4.4.0-139.165","4.4.0-140.166","4.4.0-141.167","4.4.0-142.168","4.4.0-143.169","4.4.0-145.171","4.4.0-146.172","4.4.0-148.174","4.4.0-150.176","4.4.0-151.178","4.4.0-154.181","4.4.0-157.185","4.4.0-159.187","4.4.0-161.189","4.4.0-164.192","4.4.0-165.193","4.4.0-166.195","4.4.0-168.197","4.4.0-169.198","4.4.0-170.199","4.4.0-171.200","4.4.0-173.203","4.4.0-174.204","4.4.0-176.206","4.4.0-177.207","4.4.0-178.208","4.4.0-179.209","4.4.0-184.214","4.4.0-185.215","4.4.0-186.216","4.4.0-187.217","4.4.0-189.219","4.4.0-190.220","4.4.0-193.224","4.4.0-194.226","4.4.0-197.229","4.4.0-198.230","4.4.0-200.232","4.4.0-201.233","4.4.0-203.235","4.4.0-204.236","4.4.0-206.238","4.4.0-208.240","4.4.0-209.241","4.4.0-210.242","4.4.0-211.243","4.4.0-212.244","4.4.0-213.245","4.4.0-214.246","4.4.0-216.249","4.4.0-217.250","4.4.0-218.251","4.4.0-219.252","4.4.0-221.254","4.4.0-222.255","4.4.0-223.256","4.4.0-224.257","4.4.0-227.261","4.4.0-229.263","4.4.0-230.264","4.4.0-231.265","4.4.0-233.267","4.4.0-234.268","4.4.0-235.269","4.4.0-236.270","4.4.0-237.271","4.4.0-239.273","4.4.0-240.274","4.4.0-241.275","4.4.0-242.276","4.4.0-243.277","4.4.0-244.278","4.4.0-245.279","4.4.0-246.280","4.4.0-248.282","4.4.0-250.284","4.4.0-251.285","4.4.0-252.286","4.4.0-253.287","4.4.0-254.288","4.4.0-256.290","4.4.0-257.291","4.4.0-258.292","4.4.0-259.293","4.4.0-260.294","4.4.0-261.295","4.4.0-262.296","4.4.0-263.297","4.4.0-264.298","4.4.0-266.300","4.4.0-267.301","4.4.0-268.302","4.4.0-269.303","4.4.0-270.304","4.4.0-271.305","4.4.0-272.306","4.4.0-273.307","4.4.0-274.308","4.4.0-276.310","4.4.0-277.311","4.4.0-278.312","4.4.0-279.313","4.4.0-280.314","4.4.0-281.315","4.4.0-283.317","4.4.0-284.318","4.4.0-287.321","4.4.0-288.322","4.4.0-289.323","4.4.0-290.324","4.4.0-291.325"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31","4.4.0-1026.35","4.4.0-1028.37","4.4.0-1030.39","4.4.0-1031.40","4.4.0-1032.41","4.4.0-1035.44","4.4.0-1037.46","4.4.0-1038.47","4.4.0-1039.48","4.4.0-1041.50","4.4.0-1043.52","4.4.0-1044.53","4.4.0-1047.56","4.4.0-1048.57","4.4.0-1049.58","4.4.0-1050.59","4.4.0-1052.61","4.4.0-1054.63","4.4.0-1055.64","4.4.0-1057.66","4.4.0-1060.69","4.4.0-1061.70","4.4.0-1062.71","4.4.0-1063.72","4.4.0-1065.75","4.4.0-1066.76","4.4.0-1067.77","4.4.0-1069.79","4.4.0-1070.80","4.4.0-1072.82","4.4.0-1073.83","4.4.0-1074.84","4.4.0-1075.85","4.4.0-1077.87","4.4.0-1079.89","4.4.0-1081.91","4.4.0-1083.93","4.4.0-1084.94","4.4.0-1085.96","4.4.0-1087.98","4.4.0-1088.99","4.4.0-1090.101","4.4.0-1092.103","4.4.0-1094.105","4.4.0-1095.106","4.4.0-1096.107","4.4.0-1098.109","4.4.0-1099.110","4.4.0-1100.111","4.4.0-1101.112","4.4.0-1102.113","4.4.0-1104.115","4.4.0-1105.116","4.4.0-1106.117","4.4.0-1107.118","4.4.0-1109.120","4.4.0-1110.121","4.4.0-1111.123","4.4.0-1112.124","4.4.0-1113.126","4.4.0-1114.127","4.4.0-1117.131","4.4.0-1118.132","4.4.0-1119.133","4.4.0-1121.135","4.4.0-1122.136","4.4.0-1123.137","4.4.0-1124.138","4.4.0-1126.140","4.4.0-1127.141","4.4.0-1128.142","4.4.0-1129.143","4.4.0-1130.144","4.4.0-1131.145","4.4.0-1132.146","4.4.0-1133.147","4.4.0-1134.148","4.4.0-1135.149","4.4.0-1137.151","4.4.0-1138.152","4.4.0-1139.153","4.4.0-1140.154","4.4.0-1143.158","4.4.0-1145.160","4.4.0-1146.161","4.4.0-1147.162","4.4.0-1148.163","4.4.0-1150.165","4.4.0-1151.166","4.4.0-1152.167","4.4.0-1153.168","4.4.0-1154.169","4.4.0-1155.170","4.4.0-1156.171","4.4.0-1157.172","4.4.0-1158.173","4.4.0-1159.174","4.4.0-1160.175","4.4.0-1161.176","4.4.0-1162.177","4.4.0-1163.178","4.4.0-1164.179","4.4.0-1165.180","4.4.0-1166.181","4.4.0-1167.182","4.4.0-1168.183","4.4.0-1169.184","4.4.0-1171.186","4.4.0-1172.187","4.4.0-1173.188","4.4.0-1174.189","4.4.0-1175.190","4.4.0-1176.191","4.4.0-1177.192","4.4.0-1178.193","4.4.0-1179.194","4.4.0-1180.195","4.4.0-1181.196","4.4.0-1182.197","4.4.0-1183.198","4.4.0-1184.199","4.4.0-1185.200","4.4.0-1186.201","4.4.0-1187.202","4.4.0-1188.203","4.4.0-1189.204","4.4.0-1190.205","4.4.0-1191.206","4.4.0-1192.207","4.4.0-1193.208","4.4.0-1194.209","4.4.0-1195.210","4.4.0-1196.211","4.4.0-1197.212","4.4.0-1198.213","4.4.0-1199.214","4.4.0-1200.215"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.31~16.04.1","4.15.0-1031.33~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1035.37~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1039.41~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43~16.04.1","4.15.0-1043.45~16.04.1","4.15.0-1044.46~16.04.1","4.15.0-1045.47~16.04.1","4.15.0-1047.49~16.04.1","4.15.0-1048.50~16.04.1","4.15.0-1050.52~16.04.1","4.15.0-1051.53~16.04.1","4.15.0-1052.54~16.04.1","4.15.0-1054.56~16.04.1","4.15.0-1056.58~16.04.1","4.15.0-1057.59~16.04.1","4.15.0-1058.60~16.04.1","4.15.0-1060.62~16.04.1","4.15.0-1063.67~16.04.1","4.15.0-1065.69~16.04.1","4.15.0-1066.70~16.04.1","4.15.0-1067.71~16.04.1","4.15.0-1073.77~16.04.1","4.15.0-1074.78~16.04.1","4.15.0-1079.83~16.04.1","4.15.0-1080.84~16.04.1","4.15.0-1082.86~16.04.1","4.15.0-1083.87~16.04.1","4.15.0-1085.90~16.04.1","4.15.0-1088.93~16.04.1","4.15.0-1090.95~16.04.1","4.15.0-1091.96~16.04.1","4.15.0-1093.99~16.04.1","4.15.0-1094.101~16.04.1","4.15.0-1095.102~16.04.1","4.15.0-1096.103~16.04.1","4.15.0-1097.104~16.04.1","4.15.0-1098.105~16.04.1","4.15.0-1099.106~16.04.1","4.15.0-1102.109~16.04.1","4.15.0-1103.110~16.04.1","4.15.0-1106.113~16.04.1","4.15.0-1109.116~16.04.1","4.15.0-1110.117~16.04.1","4.15.0-1111.118~16.04.1","4.15.0-1112.119~16.04.1","4.15.0-1113.120~16.04.1","4.15.0-1115.122~16.04.1","4.15.0-1116.123~16.04.1","4.15.0-1118.125~16.04.1","4.15.0-1119.126~16.04.2","4.15.0-1120.128~16.04.1","4.15.0-1123.132~16.04.1","4.15.0-1124.133~16.04.1","4.15.0-1126.135~16.04.2","4.15.0-1127.136~16.04.1","4.15.0-1128.137~16.04.1","4.15.0-1130.139~16.04.1","4.15.0-1133.143~16.04.1","4.15.0-1136.147~16.04.1","4.15.0-1137.148~16.04.1","4.15.0-1139.150~16.04.1","4.15.0-1140.151~16.04.1","4.15.0-1141.152~16.04.1","4.15.0-1142.154~16.04.1","4.15.0-1143.155~16.04.1","4.15.0-1146.158~16.04.2","4.15.0-1147.159~16.04.1","4.15.0-1148.160~16.04.1","4.15.0-1151.164~16.04.1","4.15.0-1153.166~16.04.1","4.15.0-1154.167~16.04.1","4.15.0-1155.168~16.04.1","4.15.0-1156.169~16.04.1","4.15.0-1157.170~16.04.1","4.15.0-1158.171~16.04.1","4.15.0-1159.172~16.04.1","4.15.0-1160.173~16.04.1","4.15.0-1161.174~16.04.1","4.15.0-1162.175~16.04.1","4.15.0-1163.176~16.04.1","4.15.0-1164.177~16.04.1","4.15.0-1165.178~16.04.1","4.15.0-1166.179~16.04.1","4.15.0-1167.180~16.04.1","4.15.0-1168.181~16.04.1","4.15.0-1169.182~16.04.1","4.15.0-1170.183~16.04.1","4.15.0-1172.185~16.04.1","4.15.0-1173.186~16.04.1","4.15.0-1174.187~16.04.1","4.15.0-1175.188~16.04.1","4.15.0-1176.189~16.04.1","4.15.0-1177.190~16.04.1","4.15.0-1178.191~16.04.1","4.15.0-1179.192~16.04.1","4.15.0-1180.193~16.04.1","4.15.0-1181.194~16.04.1","4.15.0-1182.195~16.04.1","4.15.0-1183.196~16.04.1","4.15.0-1184.197~16.04.1","4.15.0-1185.198~16.04.1","4.15.0-1186.199~16.04.1","4.15.0-1187.200~16.04.1","4.15.0-1188.201~16.04.1","4.15.0-1189.202~16.04.1","4.15.0-1190.203~16.04.1","4.15.0-1191.204~16.04.1","4.15.0-1192.205~16.04.1","4.15.0-1194.207~16.04.1","4.15.0-1195.208~16.04.1","4.15.0-1196.209~16.04.1","4.15.0-1197.210~16.04.1","4.15.0-1198.211~16.04.1","4.15.0-1199.212~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1","4.15.0-1031.32~16.04.1","4.15.0-1032.33~16.04.1","4.15.0-1035.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1039.43","4.15.0-1040.44","4.15.0-1041.45","4.15.0-1042.46","4.15.0-1045.49","4.15.0-1046.50","4.15.0-1047.51","4.15.0-1049.54","4.15.0-1050.55","4.15.0-1051.56","4.15.0-1052.57","4.15.0-1055.60","4.15.0-1056.61","4.15.0-1057.62","4.15.0-1059.64","4.15.0-1060.65","4.15.0-1061.66","4.15.0-1063.68","4.15.0-1064.69","4.15.0-1066.71","4.15.0-1067.72","4.15.0-1069.74","4.15.0-1071.76","4.15.0-1075.80","4.15.0-1077.82","4.15.0-1082.92~16.04.1","4.15.0-1083.93~16.04.1","4.15.0-1089.99~16.04.1","4.15.0-1091.101~16.04.1","4.15.0-1092.102~16.04.1","4.15.0-1093.103~16.04.1","4.15.0-1095.105~16.04.1","4.15.0-1096.106~16.04.1","4.15.0-1098.109~16.04.1","4.15.0-1100.111~16.04.1","4.15.0-1102.113~16.04.1","4.15.0-1103.114~16.04.1","4.15.0-1106.118~16.04.1","4.15.0-1108.120~16.04.1","4.15.0-1109.121~16.04.1","4.15.0-1110.122~16.04.1","4.15.0-1111.123~16.04.1","4.15.0-1112.124~16.04.1","4.15.0-1113.126~16.04.1","4.15.0-1114.127~16.04.1","4.15.0-1115.128~16.04.1","4.15.0-1118.131~16.04.1","4.15.0-1121.134~16.04.1","4.15.0-1122.135~16.04.1","4.15.0-1123.136~16.04.1","4.15.0-1124.137~16.04.1","4.15.0-1125.138~16.04.1","4.15.0-1126.139~16.04.1","4.15.0-1127.140~16.04.1","4.15.0-1129.142~16.04.1","4.15.0-1130.143~16.04.1","4.15.0-1131.144~16.04.1","4.15.0-1133.146~16.04.1","4.15.0-1134.147~16.04.1","4.15.0-1136.149~16.04.1","4.15.0-1137.150~16.04.1","4.15.0-1138.151~16.04.1","4.15.0-1139.152~16.04.1","4.15.0-1142.156~16.04.1","4.15.0-1145.160~16.04.1","4.15.0-1146.161~16.04.1","4.15.0-1149.164~16.04.1","4.15.0-1150.165~16.04.1","4.15.0-1151.166~16.04.1","4.15.0-1153.168~16.04.1","4.15.0-1159.174~16.04.1","4.15.0-1162.177~16.04.1","4.15.0-1163.178~16.04.1","4.15.0-1164.179~16.04.1","4.15.0-1165.180~16.04.1","4.15.0-1166.181~16.04.1","4.15.0-1167.182~16.04.1","4.15.0-1168.183~16.04.1","4.15.0-1169.184~16.04.1","4.15.0-1170.185~16.04.1","4.15.0-1171.186~16.04.1","4.15.0-1172.187~16.04.1","4.15.0-1173.188~16.04.1","4.15.0-1174.189~16.04.1","4.15.0-1175.190~16.04.1","4.15.0-1176.191~16.04.1","4.15.0-1177.192~16.04.1","4.15.0-1178.193~16.04.1","4.15.0-1179.194~16.04.1","4.15.0-1180.195~16.04.1","4.15.0-1181.196~16.04.1","4.15.0-1182.197~16.04.1","4.15.0-1183.198~16.04.1","4.15.0-1184.199~16.04.1","4.15.0-1185.200~16.04.1","4.15.0-1186.201~16.04.1","4.15.0-1187.202~16.04.1","4.15.0-1188.203~16.04.1","4.15.0-1189.204~16.04.1","4.15.0-1190.205~16.04.1","4.15.0-1191.206~16.04.1","4.15.0-1192.207~16.04.1","4.15.0-1193.208~16.04.1","4.15.0-1194.209~16.04.1","4.15.0-1195.210~16.04.1","4.15.0-1196.211~16.04.1","4.15.0-1197.212~16.04.1","4.15.0-1200.215~16.04.1","4.15.0-1204.219~16.04.1","4.15.0-1205.220~16.04.1","4.15.0-1206.221~16.04.1","4.15.0-1208.223~16.04.1","4.15.0-1209.224~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1024.25~16.04.2","4.15.0-1025.26~16.04.1","4.15.0-1026.27~16.04.1","4.15.0-1027.28~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1029.31~16.04.1","4.15.0-1030.32~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1034.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1046.49","4.15.0-1047.50","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.56","4.15.0-1055.59","4.15.0-1058.62","4.15.0-1060.64","4.15.0-1061.65","4.15.0-1071.81~16.04.1","4.15.0-1077.87~16.04.1","4.15.0-1078.88~16.04.1","4.15.0-1080.90~16.04.1","4.15.0-1081.92~16.04.1","4.15.0-1083.94~16.04.1","4.15.0-1084.95~16.04.1","4.15.0-1086.98~16.04.1","4.15.0-1087.100~16.04.1","4.15.0-1088.101~16.04.1","4.15.0-1090.103~16.04.1","4.15.0-1091.104~16.04.1","4.15.0-1092.105~16.04.1","4.15.0-1093.106~16.04.1","4.15.0-1094.107~16.04.1","4.15.0-1095.108~16.04.1","4.15.0-1096.109~16.04.1","4.15.0-1097.110~16.04.1","4.15.0-1098.111~16.04.1","4.15.0-1099.112~16.04.1","4.15.0-1100.113~16.04.1","4.15.0-1103.116~16.04.1","4.15.0-1106.120~16.04.1","4.15.0-1107.121~16.04.1","4.15.0-1108.122~16.04.1","4.15.0-1109.123~16.04.1","4.15.0-1110.124~16.04.1","4.15.0-1111.125~16.04.1","4.15.0-1112.126~16.04.1","4.15.0-1114.128~16.04.1","4.15.0-1115.129~16.04.1","4.15.0-1116.130~16.04.1","4.15.0-1118.132~16.04.1","4.15.0-1119.133~16.04.1","4.15.0-1120.134~16.04.1","4.15.0-1121.135~16.04.1","4.15.0-1122.136~16.04.1","4.15.0-1124.138~16.04.1","4.15.0-1127.142~16.04.1","4.15.0-1130.146~16.04.1","4.15.0-1131.147~16.04.1","4.15.0-1134.150~16.04.2","4.15.0-1135.151~16.04.2","4.15.0-1136.152~16.04.1","4.15.0-1137.153~16.04.1","4.15.0-1138.154~16.04.1","4.15.0-1141.157~16.04.2","4.15.0-1142.158~16.04.1","4.15.0-1143.159~16.04.1","4.15.0-1146.162~16.04.1","4.15.0-1147.163~16.04.1","4.15.0-1148.164~16.04.1","4.15.0-1149.165~16.04.1","4.15.0-1150.166~16.04.1","4.15.0-1151.167~16.04.1","4.15.0-1152.168~16.04.1","4.15.0-1153.170~16.04.1","4.15.0-1154.171~16.04.1","4.15.0-1155.172~16.04.1","4.15.0-1156.173~16.04.1","4.15.0-1157.174~16.04.1","4.15.0-1158.175~16.04.1","4.15.0-1159.176~16.04.1","4.15.0-1160.177~16.04.1","4.15.0-1161.178~16.04.1","4.15.0-1162.179~16.04.1","4.15.0-1163.180~16.04.1","4.15.0-1164.181~16.04.1","4.15.0-1165.182~16.04.1","4.15.0-1166.183~16.04.1","4.15.0-1167.184~16.04.2","4.15.0-1168.185~16.04.1","4.15.0-1169.186~16.04.1","4.15.0-1170.187~16.04.1","4.15.0-1171.188~16.04.1","4.15.0-1172.189~16.04.1","4.15.0-1173.190~16.04.1","4.15.0-1174.191~16.04.1","4.15.0-1175.192~16.04.1","4.15.0-1176.193~16.04.1","4.15.0-1177.194~16.04.1","4.15.0-1178.195~16.04.1","4.15.0-1179.196~16.04.1","4.15.0-1180.197~16.04.1","4.15.0-1181.198~16.04.1","4.15.0-1182.199~16.04.1","4.15.0-1183.200~16.04.2","4.15.0-1184.201~16.04.1","4.15.0-1185.202~16.04.1","4.15.0-1187.204~16.04.1","4.15.0-1188.205~16.04.1","4.15.0-1189.206~16.04.1","4.15.0-1190.207~16.04.1","4.15.0-1191.208~16.04.1","4.15.0-1192.209~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1","4.15.0-39.42~16.04.1","4.15.0-42.45~16.04.1","4.15.0-43.46~16.04.1","4.15.0-45.48~16.04.1","4.15.0-46.49~16.04.1","4.15.0-47.50~16.04.1","4.15.0-48.51~16.04.1","4.15.0-50.54~16.04.1","4.15.0-51.55~16.04.1","4.15.0-52.56~16.04.1","4.15.0-54.58~16.04.1","4.15.0-55.60~16.04.2","4.15.0-58.64~16.04.1","4.15.0-60.67~16.04.1","4.15.0-62.69~16.04.1","4.15.0-64.73~16.04.1","4.15.0-65.74~16.04.1","4.15.0-66.75~16.04.1","4.15.0-69.78~16.04.1","4.15.0-70.79~16.04.1","4.15.0-72.81~16.04.1","4.15.0-74.83~16.04.1","4.15.0-76.86~16.04.1","4.15.0-88.88~16.04.1","4.15.0-91.92~16.04.1","4.15.0-96.97~16.04.1","4.15.0-99.100~16.04.1","4.15.0-101.102~16.04.1","4.15.0-106.107~16.04.1","4.15.0-107.108~16.04.1","4.15.0-112.113~16.04.1","4.15.0-115.116~16.04.1","4.15.0-117.118~16.04.1","4.15.0-118.119~16.04.1","4.15.0-120.122~16.04.1","4.15.0-122.124~16.04.1","4.15.0-123.126~16.04.1","4.15.0-126.129~16.04.1","4.15.0-128.131~16.04.1","4.15.0-129.132~16.04.1","4.15.0-132.136~16.04.1","4.15.0-133.137~16.04.1","4.15.0-136.140~16.04.1","4.15.0-137.141~16.04.1","4.15.0-139.143~16.04.1","4.15.0-140.144~16.04.1","4.15.0-142.146~16.04.1","4.15.0-143.147~16.04.3","4.15.0-144.148~16.04.1","4.15.0-147.151~16.04.1","4.15.0-151.157~16.04.1","4.15.0-153.160~16.04.1","4.15.0-154.161~16.04.1","4.15.0-156.163~16.04.1","4.15.0-158.166~16.04.1","4.15.0-159.167~16.04.1","4.15.0-161.169~16.04.1","4.15.0-162.170~16.04.1","4.15.0-163.171~16.04.1","4.15.0-166.174~16.04.1","4.15.0-167.175~16.04.1","4.15.0-169.177~16.04.1","4.15.0-171.180~16.04.1","4.15.0-173.182~16.04.1","4.15.0-175.184~16.04.1","4.15.0-176.185~16.04.1","4.15.0-177.186~16.04.1","4.15.0-180.189~16.04.1","4.15.0-184.194~16.04.1","4.15.0-187.198~16.04.1","4.15.0-188.199~16.04.1","4.15.0-189.200~16.04.1","4.15.0-191.202~16.04.1","4.15.0-192.203~16.04.1","4.15.0-193.204~16.04.1","4.15.0-194.205~16.04.1","4.15.0-196.207~16.04.1","4.15.0-197.208~16.04.1","4.15.0-200.211~16.04.2","4.15.0-201.212~16.04.1","4.15.0-202.213~16.04.1","4.15.0-206.217~16.04.1","4.15.0-208.219~16.04.1","4.15.0-209.220~16.04.1","4.15.0-210.221~16.04.1","4.15.0-211.222~16.04.1","4.15.0-212.223~16.04.1","4.15.0-213.224~16.04.1","4.15.0-214.225~16.04.1","4.15.0-216.227~16.04.1","4.15.0-218.229~16.04.1","4.15.0-219.230~16.04.1","4.15.0-220.231~16.04.1","4.15.0-221.232~16.04.1","4.15.0-222.233~16.04.1","4.15.0-223.235~16.04.1","4.15.0-224.236~16.04.1","4.15.0-225.237~16.04.1","4.15.0-226.238~16.04.1","4.15.0-227.239~16.04.1","4.15.0-228.240~16.04.1","4.15.0-229.241~16.04.1","4.15.0-230.242~16.04.1","4.15.0-231.243~16.04.1","4.15.0-232.244~16.04.1","4.15.0-233.245~16.04.1","4.15.0-234.246~16.04.1","4.15.0-235.247~16.04.1","4.15.0-236.248~16.04.1","4.15.0-237.249~16.04.1","4.15.0-238.250~16.04.1","4.15.0-239.251~16.04.1","4.15.0-240.252~16.04.1","4.15.0-241.253~16.04.1","4.15.0-242.254~16.04.1","4.15.0-243.255~16.04.1","4.15.0-245.257~16.04.1","4.15.0-246.258~16.04.1","4.15.0-247.259~16.04.1","4.15.0-248.260~16.04.1","4.15.0-249.261~16.04.1","4.15.0-250.262~16.04.1","4.15.0-253.265~16.04.1","4.15.0-254.266~16.04.1","4.15.0-257.269~16.04.1","4.15.0-260.272~16.04.2","4.15.0-261.273~16.04.1","4.15.0-262.274~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1004.9","4.4.0-1007.12","4.4.0-1008.13","4.4.0-1009.14","4.4.0-1010.15","4.4.0-1012.17","4.4.0-1013.18","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1020.25","4.4.0-1021.26","4.4.0-1023.28","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1029.34","4.4.0-1031.37","4.4.0-1032.38","4.4.0-1033.39","4.4.0-1035.41","4.4.0-1036.42","4.4.0-1037.43","4.4.0-1038.44","4.4.0-1039.45","4.4.0-1040.46","4.4.0-1041.47","4.4.0-1043.49","4.4.0-1044.50","4.4.0-1046.52","4.4.0-1047.53","4.4.0-1048.55","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1056.63","4.4.0-1058.65","4.4.0-1059.66","4.4.0-1060.67","4.4.0-1062.69","4.4.0-1063.70","4.4.0-1064.71","4.4.0-1065.72","4.4.0-1066.73","4.4.0-1068.75","4.4.0-1069.76","4.4.0-1070.77","4.4.0-1071.78","4.4.0-1075.82","4.4.0-1076.83","4.4.0-1077.84","4.4.0-1078.85","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1082.91","4.4.0-1084.93","4.4.0-1085.94","4.4.0-1087.96","4.4.0-1088.97","4.4.0-1089.98","4.4.0-1090.99","4.4.0-1091.100","4.4.0-1092.101","4.4.0-1093.102","4.4.0-1094.103","4.4.0-1095.104","4.4.0-1096.105","4.4.0-1097.106","4.4.0-1098.107","4.4.0-1099.108","4.4.0-1100.109","4.4.0-1102.111","4.4.0-1103.112","4.4.0-1104.113","4.4.0-1105.114","4.4.0-1108.118","4.4.0-1110.120","4.4.0-1111.121","4.4.0-1112.122","4.4.0-1113.123","4.4.0-1114.124","4.4.0-1115.125","4.4.0-1116.126","4.4.0-1117.127","4.4.0-1118.128","4.4.0-1119.129","4.4.0-1120.130","4.4.0-1121.131","4.4.0-1122.132","4.4.0-1123.133","4.4.0-1124.134","4.4.0-1125.135","4.4.0-1126.136","4.4.0-1128.138","4.4.0-1129.139","4.4.0-1130.140","4.4.0-1131.141","4.4.0-1132.142","4.4.0-1134.144","4.4.0-1135.145","4.4.0-1136.146","4.4.0-1137.147","4.4.0-1138.148","4.4.0-1139.149","4.4.0-1140.151","4.4.0-1141.152","4.4.0-1142.153","4.4.0-1143.154","4.4.0-1144.155","4.4.0-1145.156","4.4.0-1146.157","4.4.0-1147.158","4.4.0-1148.159","4.4.0-1149.160","4.4.0-1150.161","4.4.0-1151.162","4.4.0-1152.163","4.4.0-1153.164","4.4.0-1154.165","4.4.0-1155.166","4.4.0-1156.167","4.4.0-1157.168","4.4.0-1158.169","4.4.0-1159.170","4.4.0-1160.171","4.4.0-1161.172","4.4.0-1162.173","4.4.0-1163.174"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1007.9~16.04.1","4.15.0-1008.10~16.04.1","4.15.0-1009.11~16.04.1","4.15.0-1010.12~16.04.1","4.15.0-1011.13~16.04.1","4.15.0-1013.15~16.04.1","4.15.0-1014.16~16.04.1","4.15.0-1015.17~16.04.1","4.15.0-1017.19~16.04.2","4.15.0-1018.20~16.04.1","4.15.0-1021.23~16.04.1","4.15.0-1022.25~16.04.1","4.15.0-1023.26~16.04.1","4.15.0-1025.28~16.04.1","4.15.0-1026.29~16.04.1","4.15.0-1027.30~16.04.1","4.15.0-1029.32~16.04.1","4.15.0-1030.33~16.04.1","4.15.0-1031.34~16.04.1","4.15.0-1033.36~16.04.1","4.15.0-1035.38~16.04.1","4.15.0-1037.41~16.04.1","4.15.0-1038.42~16.04.1","4.15.0-1039.43~16.04.1","4.15.0-1045.49~16.04.1","4.15.0-1046.50~16.04.1","4.15.0-1050.54~16.04.1","4.15.0-1051.55~16.04.1","4.15.0-1053.57~16.04.1","4.15.0-1054.58~16.04.1","4.15.0-1056.61~16.04.1","4.15.0-1058.64~16.04.1","4.15.0-1059.65~16.04.1","4.15.0-1061.67~16.04.1","4.15.0-1062.68~16.04.1","4.15.0-1064.71~16.04.1","4.15.0-1065.73~16.04.1","4.15.0-1066.74~16.04.1","4.15.0-1067.75~16.04.1","4.15.0-1068.76~16.04.1","4.15.0-1069.77~16.04.1","4.15.0-1070.78~16.04.1","4.15.0-1071.79~16.04.1","4.15.0-1072.80~16.04.1","4.15.0-1075.83~16.04.1","4.15.0-1078.86~16.04.1","4.15.0-1079.87~16.04.1","4.15.0-1080.88~16.04.1","4.15.0-1081.89~16.04.1","4.15.0-1082.90~16.04.1","4.15.0-1083.91~16.04.1","4.15.0-1084.92~16.04.1","4.15.0-1085.93~16.04.1","4.15.0-1086.94~16.04.1","4.15.0-1087.95~16.04.1","4.15.0-1089.98~16.04.1","4.15.0-1090.99~16.04.1","4.15.0-1091.100~16.04.1","4.15.0-1092.101~16.04.1","4.15.0-1093.102~16.04.1","4.15.0-1095.104~16.04.1","4.15.0-1098.108~16.04.1","4.15.0-1101.112~16.04.1","4.15.0-1102.113~16.04.1","4.15.0-1104.115~16.04.1","4.15.0-1105.116~16.04.1","4.15.0-1106.117~16.04.1","4.15.0-1107.118~16.04.1","4.15.0-1108.119~16.04.1","4.15.0-1111.122~16.04.2","4.15.0-1112.123~16.04.1","4.15.0-1113.124~16.04.1","4.15.0-1115.126~16.04.1","4.15.0-1116.127~16.04.1","4.15.0-1117.128~16.04.1","4.15.0-1118.129~16.04.1","4.15.0-1119.130~16.04.1","4.15.0-1120.131~16.04.1","4.15.0-1121.132~16.04.1","4.15.0-1122.133~16.04.1","4.15.0-1123.134~16.04.1","4.15.0-1124.135~16.04.1","4.15.0-1125.136~16.04.1","4.15.0-1126.137~16.04.1","4.15.0-1127.138~16.04.1","4.15.0-1128.139~16.04.1","4.15.0-1129.140~16.04.1","4.15.0-1130.141~16.04.1","4.15.0-1131.142~16.04.1","4.15.0-1132.143~16.04.1","4.15.0-1133.144~16.04.1","4.15.0-1134.145~16.04.1","4.15.0-1135.146~16.04.1","4.15.0-1136.147~16.04.1","4.15.0-1137.148~16.04.1","4.15.0-1138.149~16.04.1","4.15.0-1139.150~16.04.1","4.15.0-1140.151~16.04.1","4.15.0-1141.152~16.04.1","4.15.0-1142.153~16.04.1","4.15.0-1143.154~16.04.1","4.15.0-1144.155~16.04.1","4.15.0-1145.156~16.04.1","4.15.0-1148.159~16.04.1","4.15.0-1149.160~16.04.1","4.15.0-1150.161~16.04.1","4.15.0-1151.162~16.04.1","4.15.0-1153.164~16.04.1","4.15.0-1154.165~16.04.1","4.15.0-1156.167~16.04.1","4.15.0-1158.169~16.04.1","4.15.0-1160.171~16.04.1","4.15.0-1161.172~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1008.10","4.4.0-1010.13","4.4.0-1011.14","4.4.0-1012.16","4.4.0-1013.17","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1021.26","4.4.0-1022.27","4.4.0-1023.28","4.4.0-1025.30","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1028.33","4.4.0-1029.34","4.4.0-1031.36","4.4.0-1032.37","4.4.0-1033.38","4.4.0-1034.39","4.4.0-1041.46","4.4.0-1042.47","4.4.0-1043.48","4.4.0-1044.49","4.4.0-1045.50","4.4.0-1046.51","4.4.0-1048.53","4.4.0-1049.55","4.4.0-1051.57","4.4.0-1052.58","4.4.0-1054.60","4.4.0-1055.61","4.4.0-1056.62","4.4.0-1057.63","4.4.0-1058.64","4.4.0-1060.66","4.4.0-1061.67","4.4.0-1062.68","4.4.0-1063.69","4.4.0-1064.70","4.4.0-1065.71","4.4.0-1066.72","4.4.0-1067.73","4.4.0-1068.74","4.4.0-1069.75","4.4.0-1071.77","4.4.0-1072.78","4.4.0-1073.79","4.4.0-1074.80","4.4.0-1077.84","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1081.88","4.4.0-1082.89","4.4.0-1083.90","4.4.0-1084.91","4.4.0-1085.92","4.4.0-1086.93","4.4.0-1088.95","4.4.0-1089.96","4.4.0-1090.97","4.4.0-1091.98","4.4.0-1092.99","4.4.0-1093.100","4.4.0-1094.101","4.4.0-1095.102","4.4.0-1097.104","4.4.0-1099.106","4.4.0-1100.107","4.4.0-1101.108","4.4.0-1102.109","4.4.0-1103.110","4.4.0-1104.111","4.4.0-1105.112","4.4.0-1106.113","4.4.0-1107.114","4.4.0-1108.115","4.4.0-1109.116","4.4.0-1110.117","4.4.0-1111.118","4.4.0-1112.119","4.4.0-1113.120","4.4.0-1114.121","4.4.0-1115.122","4.4.0-1116.123","4.4.0-1117.124","4.4.0-1119.126","4.4.0-1120.127","4.4.0-1121.128","4.4.0-1122.129","4.4.0-1123.130","4.4.0-1124.131","4.4.0-1125.132","4.4.0-1126.133","4.4.0-1127.134","4.4.0-1128.135","4.4.0-1129.136","4.4.0-1130.137","4.4.0-1131.138"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.1","4.4.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41","4.15.0-39.42","4.15.0-42.45","4.15.0-43.46","4.15.0-44.47","4.15.0-45.48","4.15.0-46.49","4.15.0-47.50","4.15.0-48.51","4.15.0-50.54","4.15.0-51.55","4.15.0-52.56","4.15.0-54.58","4.15.0-55.60","4.15.0-58.64","4.15.0-60.67","4.15.0-62.69","4.15.0-64.73","4.15.0-65.74","4.15.0-66.75","4.15.0-69.78","4.15.0-70.79","4.15.0-72.81","4.15.0-74.84","4.15.0-76.86","4.15.0-88.88","4.15.0-91.92","4.15.0-96.97","4.15.0-99.100","4.15.0-101.102","4.15.0-106.107","4.15.0-108.109","4.15.0-109.110","4.15.0-111.112","4.15.0-112.113","4.15.0-115.116","4.15.0-117.118","4.15.0-118.119","4.15.0-121.123","4.15.0-122.124","4.15.0-123.126","4.15.0-124.127","4.15.0-126.129","4.15.0-128.131","4.15.0-129.132","4.15.0-130.134","4.15.0-132.136","4.15.0-134.138","4.15.0-135.139","4.15.0-136.140","4.15.0-137.141","4.15.0-139.143","4.15.0-140.144","4.15.0-141.145","4.15.0-142.146","4.15.0-143.147","4.15.0-144.148","4.15.0-147.151","4.15.0-151.157","4.15.0-153.160","4.15.0-154.161","4.15.0-156.163","4.15.0-158.166","4.15.0-159.167","4.15.0-161.169","4.15.0-162.170","4.15.0-163.171","4.15.0-166.174","4.15.0-167.175","4.15.0-169.177","4.15.0-171.180","4.15.0-173.182","4.15.0-175.184","4.15.0-176.185","4.15.0-177.186","4.15.0-180.189","4.15.0-184.194","4.15.0-187.198","4.15.0-188.199","4.15.0-189.200","4.15.0-191.202","4.15.0-192.203","4.15.0-193.204","4.15.0-194.205","4.15.0-196.207","4.15.0-197.208","4.15.0-200.211","4.15.0-201.212","4.15.0-202.213","4.15.0-204.215","4.15.0-206.217","4.15.0-208.220","4.15.0-209.220","4.15.0-210.221","4.15.0-211.222","4.15.0-212.223","4.15.0-213.224","4.15.0-214.225","4.15.0-216.227","4.15.0-218.229","4.15.0-219.230","4.15.0-220.231","4.15.0-221.232","4.15.0-222.233","4.15.0-223.235","4.15.0-224.236","4.15.0-225.237","4.15.0-226.238","4.15.0-227.239","4.15.0-228.240","4.15.0-229.241","4.15.0-230.242","4.15.0-231.243","4.15.0-232.244","4.15.0-233.245","4.15.0-234.246","4.15.0-235.247","4.15.0-236.248","4.15.0-237.249","4.15.0-238.250","4.15.0-239.251","4.15.0-240.252","4.15.0-241.253","4.15.0-242.254","4.15.0-243.255","4.15.0-245.257","4.15.0-246.258","4.15.0-247.259","4.15.0-248.260","4.15.0-249.261","4.15.0-250.262","4.15.0-251.263","4.15.0-253.265","4.15.0-254.266","4.15.0-257.269","4.15.0-260.272","4.15.0-261.273","4.15.0-262.274"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1027.27","4.15.0-1029.30","4.15.0-1031.33","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1035.37","4.15.0-1037.39","4.15.0-1039.41","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1043.45","4.15.0-1044.46","4.15.0-1045.47","4.15.0-1047.49","4.15.0-1048.50","4.15.0-1050.52","4.15.0-1051.53","4.15.0-1052.54","4.15.0-1054.56","4.15.0-1056.58","4.15.0-1057.59","4.15.0-1058.60","4.15.0-1060.62","4.15.0-1063.67","4.15.0-1065.69","4.15.0-1066.70","4.15.0-1067.71","4.15.0-1073.77","4.15.0-1076.80","4.15.0-1077.81","4.15.0-1079.83","4.15.0-1080.84","4.15.0-1082.86","4.15.0-1083.87","4.15.0-1086.91","4.15.0-1087.92","4.15.0-1088.93","4.15.0-1090.95","4.15.0-1091.96","4.15.0-1092.98","4.15.0-1093.99","4.15.0-1094.101","4.15.0-1095.102","4.15.0-1096.103","4.15.0-1097.104","4.15.0-1098.105","4.15.0-1099.106","4.15.0-1101.108","4.15.0-1102.109","4.15.0-1103.110","4.15.0-1106.113","4.15.0-1109.116","4.15.0-1110.117","4.15.0-1111.118","4.15.0-1112.119","4.15.0-1114.121","4.15.0-1115.122","4.15.0-1116.123","4.15.0-1118.125","4.15.0-1119.127","4.15.0-1121.129","4.15.0-1123.132","4.15.0-1124.133","4.15.0-1126.135","4.15.0-1127.136","4.15.0-1128.137","4.15.0-1130.139","4.15.0-1133.143","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.152","4.15.0-1142.154","4.15.0-1143.155","4.15.0-1144.156","4.15.0-1146.158","4.15.0-1147.159","4.15.0-1148.160","4.15.0-1150.163","4.15.0-1151.164","4.15.0-1153.166","4.15.0-1154.167","4.15.0-1155.168","4.15.0-1156.169","4.15.0-1157.170","4.15.0-1158.171","4.15.0-1159.172","4.15.0-1160.173","4.15.0-1161.174","4.15.0-1162.175","4.15.0-1163.176","4.15.0-1164.177","4.15.0-1165.178","4.15.0-1166.179","4.15.0-1167.180","4.15.0-1168.181","4.15.0-1169.182","4.15.0-1170.183","4.15.0-1172.185","4.15.0-1173.186","4.15.0-1174.187","4.15.0-1175.188","4.15.0-1176.189","4.15.0-1177.190","4.15.0-1178.191","4.15.0-1179.192","4.15.0-1180.193","4.15.0-1181.194","4.15.0-1182.195","4.15.0-1183.196","4.15.0-1184.197","4.15.0-1185.198","4.15.0-1186.199","4.15.0-1187.200","4.15.0-1188.201","4.15.0-1189.202","4.15.0-1190.203","4.15.0-1191.204","4.15.0-1192.205","4.15.0-1194.207","4.15.0-1195.208","4.15.0-1196.209","4.15.0-1197.210","4.15.0-1198.211","4.15.0-1199.212"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1058.61~18.04.3","5.4.0-1059.62~18.04.1","5.4.0-1060.63~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1081.88~18.04.1","5.4.0-1083.90~18.04.1","5.4.0-1084.91~18.04.1","5.4.0-1085.92~18.04.1","5.4.0-1086.93~18.04.1","5.4.0-1088.96~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1090.98~18.04.1","5.4.0-1092.100~18.04.2","5.4.0-1093.102~18.04.2","5.4.0-1094.102~18.04.1","5.4.0-1096.104~18.04.1","5.4.0-1097.105~18.04.1","5.4.0-1099.107~18.04.1","5.4.0-1100.108~18.04.1","5.4.0-1101.109~18.04.1","5.4.0-1103.111~18.04.1","5.4.0-1104.112~18.04.1","5.4.0-1105.113~18.04.1","5.4.0-1106.114~18.04.1","5.4.0-1107.115~18.04.1","5.4.0-1108.116~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.2","5.4.0-1113.123~18.04.1","5.4.0-1114.124~18.04.1","5.4.0-1116.126~18.04.1","5.4.0-1117.127~18.04.1","5.4.0-1118.128~18.04.1","5.4.0-1119.129~18.04.1","5.4.0-1120.130~18.04.1","5.4.0-1121.131~18.04.1","5.4.0-1122.132~18.04.1","5.4.0-1123.133~18.04.1","5.4.0-1124.134~18.04.1","5.4.0-1125.135~18.04.1","5.4.0-1126.136~18.04.1","5.4.0-1127.137~18.04.2","5.4.0-1128.138~18.04.1","5.4.0-1129.139~18.04.1","5.4.0-1130.140~18.04.1","5.4.0-1131.141~18.04.1","5.4.0-1132.142~18.04.1","5.4.0-1133.143~18.04.1","5.4.0-1134.144~18.04.1","5.4.0-1135.145~18.04.1","5.4.0-1136.146~18.04.1","5.4.0-1137.147~18.04.1","5.4.0-1139.149~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1147.157~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1153.163~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1156.166~18.04.1","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1160.170~18.04.1","5.4.0-1161.172~18.04.1","5.4.0-1162.173~18.04.1","5.4.0-1163.174~18.04.1","5.4.0-1165.176~18.04.1","5.4.0-1167.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1082.92","4.15.0-1083.93","4.15.0-1089.99","4.15.0-1091.101","4.15.0-1092.102","4.15.0-1093.103","4.15.0-1095.105","4.15.0-1096.106","4.15.0-1099.110","4.15.0-1100.111","4.15.0-1102.113","4.15.0-1103.114","4.15.0-1104.116","4.15.0-1106.118","4.15.0-1108.120","4.15.0-1109.121","4.15.0-1110.122","4.15.0-1111.123","4.15.0-1112.125","4.15.0-1113.126","4.15.0-1114.127","4.15.0-1115.128","4.15.0-1118.131","4.15.0-1121.134","4.15.0-1122.135","4.15.0-1123.136","4.15.0-1124.137","4.15.0-1125.138","4.15.0-1126.139","4.15.0-1127.140","4.15.0-1129.142","4.15.0-1130.143","4.15.0-1131.144","4.15.0-1133.146","4.15.0-1134.147","4.15.0-1136.149","4.15.0-1137.150","4.15.0-1138.151","4.15.0-1139.152","4.15.0-1142.156","4.15.0-1145.160","4.15.0-1146.161","4.15.0-1149.164","4.15.0-1150.165","4.15.0-1151.166","4.15.0-1153.168","4.15.0-1157.172","4.15.0-1158.173","4.15.0-1159.174","4.15.0-1161.176","4.15.0-1162.177","4.15.0-1163.178","4.15.0-1164.179","4.15.0-1165.180","4.15.0-1166.181","4.15.0-1167.182","4.15.0-1168.183","4.15.0-1169.184","4.15.0-1170.185","4.15.0-1171.186","4.15.0-1172.187","4.15.0-1173.188","4.15.0-1174.189","4.15.0-1175.190","4.15.0-1176.191","4.15.0-1177.192","4.15.0-1178.193","4.15.0-1179.194","4.15.0-1180.195","4.15.0-1181.196","4.15.0-1182.197","4.15.0-1183.198","4.15.0-1184.199","4.15.0-1185.200","4.15.0-1186.201","4.15.0-1187.202","4.15.0-1188.203","4.15.0-1189.204","4.15.0-1190.205","4.15.0-1191.206","4.15.0-1192.207","4.15.0-1193.208","4.15.0-1194.209","4.15.0-1195.210","4.15.0-1196.211","4.15.0-1197.212","4.15.0-1199.214","4.15.0-1200.215","4.15.0-1201.216","4.15.0-1202.217","4.15.0-1204.219","4.15.0-1205.220","4.15.0-1206.221","4.15.0-1207.222","4.15.0-1208.223","4.15.0-1209.224"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1055.57~18.04.1","5.4.0-1056.58~18.04.1","5.4.0-1058.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1069.72~18.04.1","5.4.0-1070.73~18.04.1","5.4.0-1072.75~18.04.1","5.4.0-1073.76~18.04.1","5.4.0-1074.77~18.04.1","5.4.0-1077.80~18.04.1","5.4.0-1078.81~18.04.1","5.4.0-1080.83~18.04.2","5.4.0-1083.87~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1089.94~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1091.96~18.04.1","5.4.0-1094.100~18.04.1","5.4.0-1095.101~18.04.1","5.4.0-1098.104~18.04.2","5.4.0-1100.106~18.04.1","5.4.0-1101.107~18.04.1","5.4.0-1103.109~18.04.1","5.4.0-1104.110~18.04.1","5.4.0-1105.111~18.04.1","5.4.0-1106.112~18.04.1","5.4.0-1107.113~18.04.1","5.4.0-1108.114~18.04.1","5.4.0-1109.115~18.04.1","5.4.0-1110.116~18.04.1","5.4.0-1111.117~18.04.1","5.4.0-1112.118~18.04.1","5.4.0-1113.119~18.04.1","5.4.0-1115.122~18.04.1","5.4.0-1116.123~18.04.1","5.4.0-1117.124~18.04.1","5.4.0-1118.125~18.04.1","5.4.0-1119.126~18.04.2","5.4.0-1120.127~18.04.1","5.4.0-1121.128~18.04.1","5.4.0-1122.129~18.04.1","5.4.0-1123.130~18.04.1","5.4.0-1124.131~18.04.1","5.4.0-1126.133~18.04.1","5.4.0-1127.134~18.04.1","5.4.0-1128.135~18.04.1","5.4.0-1129.136~18.04.1","5.4.0-1130.137~18.04.1","5.4.0-1131.138~18.04.1","5.4.0-1132.139~18.04.1","5.4.0-1133.140~18.04.1","5.4.0-1134.141~18.04.1","5.4.0-1135.142~18.04.1","5.4.0-1136.143~18.04.1","5.4.0-1137.144~18.04.1","5.4.0-1138.145~18.04.1","5.4.0-1139.146~18.04.1","5.4.0-1140.147~18.04.1","5.4.0-1142.149~18.04.1","5.4.0-1143.150~18.04.1","5.4.0-1145.152~18.04.1","5.4.0-1147.154~18.04.1","5.4.0-1148.155~18.04.1","5.4.0-1149.156~18.04.1","5.4.0-1150.157~18.04.1","5.4.0-1151.158~18.04.1","5.4.0-1152.159~18.04.1","5.4.0-1153.160~18.04.1","5.4.0-1154.161~18.04.1","5.4.0-1156.163~18.04.1","5.4.0-1157.164~18.04.1","5.4.0-1161.167~18.04.1","5.4.0-1162.168~18.04.1","5.4.0-1163.169~18.04.1","5.4.0-1164.170~18.04.1","5.4.0-1166.172~18.04.1","5.4.0-1167.173~18.04.1","5.4.0-1168.174~18.04.1","5.4.0-1169.175~18.04.1","5.4.0-1170.176~18.04.1","5.4.0-1171.177~18.04.1","5.4.0-1172.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1071.81","4.15.0-1077.87","4.15.0-1078.88","4.15.0-1080.90","4.15.0-1081.92","4.15.0-1083.94","4.15.0-1084.95","4.15.0-1086.98","4.15.0-1087.100","4.15.0-1088.101","4.15.0-1090.103","4.15.0-1091.104","4.15.0-1092.105","4.15.0-1093.106","4.15.0-1094.107","4.15.0-1095.108","4.15.0-1096.109","4.15.0-1097.110","4.15.0-1098.111","4.15.0-1099.112","4.15.0-1100.113","4.15.0-1103.116","4.15.0-1106.120","4.15.0-1107.121","4.15.0-1108.122","4.15.0-1109.123","4.15.0-1110.124","4.15.0-1111.125","4.15.0-1112.126","4.15.0-1114.128","4.15.0-1115.129","4.15.0-1116.130","4.15.0-1118.132","4.15.0-1119.133","4.15.0-1120.134","4.15.0-1121.135","4.15.0-1122.136","4.15.0-1124.138","4.15.0-1127.142","4.15.0-1130.146","4.15.0-1131.147","4.15.0-1134.150","4.15.0-1135.151","4.15.0-1136.152","4.15.0-1137.153","4.15.0-1138.154","4.15.0-1141.157","4.15.0-1142.158","4.15.0-1143.159","4.15.0-1145.161","4.15.0-1146.162","4.15.0-1147.163","4.15.0-1148.164","4.15.0-1149.165","4.15.0-1150.166","4.15.0-1151.167","4.15.0-1152.168","4.15.0-1153.170","4.15.0-1154.171","4.15.0-1155.172","4.15.0-1156.173","4.15.0-1157.174","4.15.0-1158.175","4.15.0-1159.176","4.15.0-1160.177","4.15.0-1161.178","4.15.0-1162.179","4.15.0-1163.180","4.15.0-1164.181","4.15.0-1165.182","4.15.0-1166.183","4.15.0-1167.184","4.15.0-1168.185","4.15.0-1169.186","4.15.0-1170.187","4.15.0-1171.188","4.15.0-1172.189","4.15.0-1173.190","4.15.0-1174.191","4.15.0-1175.192","4.15.0-1176.193","4.15.0-1177.194","4.15.0-1178.195","4.15.0-1179.196","4.15.0-1180.197","4.15.0-1181.198","4.15.0-1182.199","4.15.0-1183.200","4.15.0-1184.201","4.15.0-1185.202","4.15.0-1186.203","4.15.0-1187.204","4.15.0-1188.205","4.15.0-1189.206","4.15.0-1190.207","4.15.0-1191.208","4.15.0-1192.209"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1051.55~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1060.64~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1065.69~18.04.1","5.4.0-1067.71~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.94~18.04.1","5.4.0-1087.95~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1096.105~18.04.2","5.4.0-1097.106~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.2","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.1","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1128.137~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1139.148~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.150~18.04.1","5.4.0-1142.151~18.04.1","5.4.0-1143.152~18.04.1","5.4.0-1145.154~18.04.1","5.4.0-1147.156~18.04.1","5.4.0-1148.157~18.04.1","5.4.0-1149.158~18.04.1","5.4.0-1150.159~18.04.1","5.4.0-1151.160~18.04.1","5.4.0-1152.161~18.04.1","5.4.0-1153.162~18.04.1","5.4.0-1154.163~18.04.1","5.4.0-1155.164~18.04.1","5.4.0-1156.165~18.04.1","5.4.0-1157.166~18.04.1","5.4.0-1159.168~18.04.1","5.4.0-1160.169~18.04.1","5.4.0-1161.170~18.04.1","5.4.0-1162.171~18.04.1","5.4.0-1163.172~18.04.1","5.4.0-1164.173~18.04.1","5.4.0-1165.174~18.04.1","5.4.0-1166.175~18.04.1","5.4.0-1167.176~18.04.1","5.4.0-1168.178~18.04.1","5.4.0-1169.179~18.04.1","5.4.0-1170.180~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1","5.4.0-80.90~18.04.1","5.4.0-81.91~18.04.1","5.4.0-84.94~18.04.1","5.4.0-86.97~18.04.1","5.4.0-87.98~18.04.1","5.4.0-89.100~18.04.1","5.4.0-90.101~18.04.1","5.4.0-91.102~18.04.1","5.4.0-92.103~18.04.2","5.4.0-94.106~18.04.1","5.4.0-96.109~18.04.1","5.4.0-97.110~18.04.1","5.4.0-99.112~18.04.1","5.4.0-100.113~18.04.1","5.4.0-104.118~18.04.1","5.4.0-105.119~18.04.1","5.4.0-107.121~18.04.1","5.4.0-109.123~18.04.1","5.4.0-110.124~18.04.1","5.4.0-113.127~18.04.1","5.4.0-117.132~18.04.1","5.4.0-120.136~18.04.1","5.4.0-121.137~18.04.1","5.4.0-122.138~18.04.1","5.4.0-124.140~18.04.1","5.4.0-125.141~18.04.1","5.4.0-126.142~18.04.1","5.4.0-128.144~18.04.1","5.4.0-131.147~18.04.1","5.4.0-132.148~18.04.1","5.4.0-133.149~18.04.1","5.4.0-135.152~18.04.2","5.4.0-136.153~18.04.1","5.4.0-137.154~18.04.1","5.4.0-139.156~18.04.1","5.4.0-144.161~18.04.1","5.4.0-146.163~18.04.1","5.4.0-147.164~18.04.1","5.4.0-148.165~18.04.1","5.4.0-149.166~18.04.1","5.4.0-150.167~18.04.1","5.4.0-152.169~18.04.1","5.4.0-153.170~18.04.1","5.4.0-155.172~18.04.1","5.4.0-156.173~18.04.1","5.4.0-159.176~18.04.1","5.4.0-162.179~18.04.1","5.4.0-163.180~18.04.1","5.4.0-164.181~18.04.1","5.4.0-165.182~18.04.1","5.4.0-166.183~18.04.2","5.4.0-167.184~18.04.1","5.4.0-169.187~18.04.1","5.4.0-170.188~18.04.1","5.4.0-171.189~18.04.1","5.4.0-172.190~18.04.1","5.4.0-173.191~18.04.1","5.4.0-174.193~18.04.1","5.4.0-175.195~18.04.1","5.4.0-177.197~18.04.1","5.4.0-181.201~18.04.1","5.4.0-182.202~18.04.1","5.4.0-186.206~18.04.1","5.4.0-187.207~18.04.1","5.4.0-189.209~18.04.1","5.4.0-190.210~18.04.1","5.4.0-192.212~18.04.1","5.4.0-193.213~18.04.1","5.4.0-195.215~18.04.1","5.4.0-196.216~18.04.1","5.4.0-198.218~18.04.1","5.4.0-200.220~18.04.1","5.4.0-202.222~18.04.1","5.4.0-204.224~18.04.1","5.4.0-205.225~18.04.1","5.4.0-208.228~18.04.1","5.4.0-211.231~18.04.1","5.4.0-212.232~18.04.1","5.4.0-214.234~18.04.1","5.4.0-215.235~18.04.1","5.4.0-216.236~18.04.1","5.4.0-218.238~18.04.1","5.4.0-219.239~18.04.1","5.4.0-220.240~18.04.1","5.4.0-221.241~18.04.1","5.4.0-222.242~18.04.1","5.4.0-223.243~18.04.1","5.4.0-224.244~18.04.1","5.4.0-225.245~18.04.1","5.4.0-227.247~18.04.1","5.4.0-228.248~18.04.1","5.4.0-229.249~18.04.1","5.4.0-231.251~18.04.1","5.4.0-233.253~18.04.1","5.4.0-234.254~18.04.1","5.4.0-238.258~18.04.1","5.4.0-241.261~18.04.1","5.4.0-242.262~18.04.1","5.4.0-244.264~18.04.1","5.4.0-245.265~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1010.11~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1017.19~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1020.22~18.04.1","5.4.0-1021.23~18.04.1","5.4.0-1023.25~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.32~18.04.1","5.4.0-1029.33~18.04.1","5.4.0-1031.35~18.04.1","5.4.0-1032.36~18.04.1","5.4.0-1033.37~18.04.1","5.4.0-1034.38~18.04.1","5.4.0-1036.41~18.04.1","5.4.0-1037.42~18.04.1","5.4.0-1040.45~18.04.2","5.4.0-1041.46~18.04.1","5.4.0-1042.47~18.04.1","5.4.0-1044.49~18.04.1","5.4.0-1045.50~18.04.1","5.4.0-1046.51~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1049.54~18.04.1","5.4.0-1050.55~18.04.1","5.4.0-1051.56~18.04.1","5.4.0-1052.57~18.04.1","5.4.0-1053.58~18.04.1","5.4.0-1054.59~18.04.1","5.4.0-1056.61~18.04.1","5.4.0-1057.62~18.04.1","5.4.0-1058.63~18.04.1","5.4.0-1059.64~18.04.1","5.4.0-1060.65~18.04.1","5.4.0-1061.66~18.04.1","5.4.0-1063.68~18.04.1","5.4.0-1064.69~18.04.1","5.4.0-1065.70~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1068.73~18.04.1","5.4.0-1069.74~18.04.1","5.4.0-1070.75~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1076.81~18.04.1","5.4.0-1077.82~18.04.1","5.4.0-1078.83~18.04.1","5.4.0-1079.84~18.04.1","5.4.0-1080.85~18.04.1","5.4.0-1081.86~18.04.1","5.4.0-1082.87~18.04.1","5.4.0-1083.88~18.04.1","5.4.0-1084.89~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1092.97~18.04.1","5.4.0-1093.98~18.04.1","5.4.0-1094.99~18.04.1","5.4.0-1095.100~18.04.1","5.4.0-1096.101~18.04.1","5.4.0-1097.102~18.04.1","5.4.0-1098.103~18.04.1","5.4.0-1099.104~18.04.1","5.4.0-1100.105~18.04.1","5.4.0-1102.107~18.04.1","5.4.0-1103.108~18.04.1","5.4.0-1104.109~18.04.1","5.4.0-1105.110~18.04.1","5.4.0-1107.112~18.04.1","5.4.0-1108.113~18.04.1","5.4.0-1109.114~18.04.1","5.4.0-1111.116~18.04.1","5.4.0-1112.117~18.04.1","5.4.0-1113.118~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1026.26","4.15.0-1027.27","4.15.0-1028.28","4.15.0-1029.29","4.15.0-1030.30","4.15.0-1031.31","4.15.0-1032.32","4.15.0-1034.34","4.15.0-1035.35","4.15.0-1036.36","4.15.0-1038.38","4.15.0-1039.39","4.15.0-1042.42","4.15.0-1043.43","4.15.0-1044.44","4.15.0-1046.46","4.15.0-1047.47","4.15.0-1048.48","4.15.0-1050.50","4.15.0-1051.51","4.15.0-1052.52","4.15.0-1053.53","4.15.0-1056.57","4.15.0-1058.59","4.15.0-1059.60","4.15.0-1060.61","4.15.0-1067.68","4.15.0-1069.70","4.15.0-1071.72","4.15.0-1072.73","4.15.0-1074.75","4.15.0-1075.76","4.15.0-1077.79","4.15.0-1079.81","4.15.0-1081.83","4.15.0-1082.84","4.15.0-1084.86","4.15.0-1085.87","4.15.0-1086.88","4.15.0-1087.89","4.15.0-1088.90","4.15.0-1089.91","4.15.0-1090.92","4.15.0-1091.93","4.15.0-1092.94","4.15.0-1094.96","4.15.0-1097.99","4.15.0-1098.100","4.15.0-1099.101","4.15.0-1100.102","4.15.0-1101.103","4.15.0-1102.104","4.15.0-1103.105","4.15.0-1105.107","4.15.0-1106.108","4.15.0-1107.109","4.15.0-1109.112","4.15.0-1110.113","4.15.0-1112.115","4.15.0-1113.116","4.15.0-1114.117","4.15.0-1116.119","4.15.0-1119.123","4.15.0-1122.127","4.15.0-1123.128","4.15.0-1125.130","4.15.0-1126.131","4.15.0-1127.132","4.15.0-1128.133","4.15.0-1129.134","4.15.0-1132.137","4.15.0-1133.138","4.15.0-1134.139","4.15.0-1135.140","4.15.0-1136.141","4.15.0-1137.142","4.15.0-1138.143","4.15.0-1139.144","4.15.0-1140.145","4.15.0-1141.146","4.15.0-1142.147","4.15.0-1143.148","4.15.0-1144.149","4.15.0-1145.150","4.15.0-1146.151","4.15.0-1147.152","4.15.0-1148.153","4.15.0-1149.154","4.15.0-1150.155","4.15.0-1151.156","4.15.0-1152.157","4.15.0-1153.158","4.15.0-1154.159","4.15.0-1155.160","4.15.0-1156.161","4.15.0-1157.162","4.15.0-1158.163","4.15.0-1159.164","4.15.0-1160.165","4.15.0-1161.166","4.15.0-1162.167","4.15.0-1163.168","4.15.0-1164.169","4.15.0-1165.170","4.15.0-1166.171","4.15.0-1167.172","4.15.0-1168.173","4.15.0-1169.174","4.15.0-1170.175","4.15.0-1171.176","4.15.0-1172.177","4.15.0-1173.178","4.15.0-1174.179","4.15.0-1175.180","4.15.0-1176.181","4.15.0-1177.182","4.15.0-1178.183","4.15.0-1179.184","4.15.0-1180.185","4.15.0-1181.186"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1007.9","4.15.0-1008.10","4.15.0-1009.11","4.15.0-1010.12","4.15.0-1011.13","4.15.0-1013.15","4.15.0-1014.16","4.15.0-1015.17","4.15.0-1017.19","4.15.0-1018.20","4.15.0-1021.23","4.15.0-1022.25","4.15.0-1023.26","4.15.0-1025.28","4.15.0-1026.29","4.15.0-1027.30","4.15.0-1029.32","4.15.0-1030.33","4.15.0-1031.34","4.15.0-1033.36","4.15.0-1035.39","4.15.0-1037.41","4.15.0-1038.42","4.15.0-1039.43","4.15.0-1045.49","4.15.0-1047.51","4.15.0-1048.52","4.15.0-1050.54","4.15.0-1051.55","4.15.0-1053.57","4.15.0-1054.58","4.15.0-1057.62","4.15.0-1058.64","4.15.0-1059.65","4.15.0-1061.67","4.15.0-1062.68","4.15.0-1063.70","4.15.0-1064.71","4.15.0-1065.73","4.15.0-1066.74","4.15.0-1067.75","4.15.0-1068.76","4.15.0-1069.77","4.15.0-1070.78","4.15.0-1071.79","4.15.0-1072.80","4.15.0-1075.83","4.15.0-1078.86","4.15.0-1079.87","4.15.0-1080.88","4.15.0-1081.89","4.15.0-1082.90","4.15.0-1083.91","4.15.0-1084.92","4.15.0-1085.93","4.15.0-1086.94","4.15.0-1087.95","4.15.0-1089.98","4.15.0-1090.99","4.15.0-1091.100","4.15.0-1092.101","4.15.0-1093.102","4.15.0-1095.104","4.15.0-1098.108","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1104.115","4.15.0-1105.116","4.15.0-1106.117","4.15.0-1107.118","4.15.0-1108.119","4.15.0-1111.122","4.15.0-1112.123","4.15.0-1113.124","4.15.0-1114.125","4.15.0-1115.126","4.15.0-1116.127","4.15.0-1117.128","4.15.0-1118.129","4.15.0-1119.130","4.15.0-1120.131","4.15.0-1121.132","4.15.0-1122.133","4.15.0-1123.134","4.15.0-1124.135","4.15.0-1125.136","4.15.0-1126.137","4.15.0-1127.138","4.15.0-1128.139","4.15.0-1129.140","4.15.0-1130.141","4.15.0-1131.142","4.15.0-1132.143","4.15.0-1133.144","4.15.0-1134.145","4.15.0-1135.146","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1138.149","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.152","4.15.0-1142.153","4.15.0-1143.154","4.15.0-1144.155","4.15.0-1145.156","4.15.0-1146.157","4.15.0-1147.158","4.15.0-1148.159","4.15.0-1149.160","4.15.0-1150.161","4.15.0-1151.162","4.15.0-1152.163","4.15.0-1153.164","4.15.0-1154.165","4.15.0-1155.166","4.15.0-1156.167","4.15.0-1158.169","4.15.0-1160.171","4.15.0-1161.172"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1054.58~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1061.65~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1069.75~18.04.1","5.4.0-1070.76~18.04.1","5.4.0-1071.77~18.04.1","5.4.0-1073.79~18.04.1","5.4.0-1076.83~18.04.1","5.4.0-1078.86~18.04.1","5.4.0-1079.87~18.04.1","5.4.0-1081.89~18.04.1","5.4.0-1082.90~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.95~18.04.1","5.4.0-1087.96~18.04.1","5.4.0-1090.99~18.04.2","5.4.0-1091.100~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1094.103~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1099.108~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.1","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.4","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1119.128~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1131.140~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.151~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1143.153~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1155.165~18.04.1","5.4.0-1156.166~18.04.2","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1159.169~18.04.1","5.4.0-1161.171~18.04.1","5.4.0-1162.172~18.04.1","5.4.0-1163.173~18.04.1","5.4.0-1164.174~18.04.1","5.4.0-1165.175~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1041.45~18.04.1","5.4.0-1042.46~18.04.3","5.4.0-1043.47~18.04.1","5.4.0-1044.48~18.04.1","5.4.0-1045.49~18.04.1","5.4.0-1046.50~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1050.56~18.04.1","5.4.0-1052.58~18.04.1","5.4.0-1053.60~18.04.1","5.4.0-1055.62~18.04.1","5.4.0-1056.63~18.04.1","5.4.0-1058.65~18.04.1","5.4.0-1059.66~18.04.1","5.4.0-1060.68~18.04.1","5.4.0-1062.70~18.04.1","5.4.0-1065.75~18.04.1","5.4.0-1066.76~18.04.1","5.4.0-1068.78~18.04.1","5.4.0-1069.79~18.04.1","5.4.0-1070.80~18.04.1","5.4.0-1071.81~18.04.1","5.4.0-1073.84~18.04.1","5.4.0-1074.85~18.04.1","5.4.0-1077.88~18.04.2","5.4.0-1078.89~18.04.1","5.4.0-1079.90~18.04.1","5.4.0-1080.91~18.04.1","5.4.0-1081.92~18.04.1","5.4.0-1082.93~18.04.1","5.4.0-1083.94~18.04.1","5.4.0-1084.95~18.04.1","5.4.0-1085.96~18.04.1","5.4.0-1086.97~18.04.1","5.4.0-1088.99~18.04.1","5.4.0-1089.100~18.04.1","5.4.0-1090.101~18.04.1","5.4.0-1091.102~18.04.1","5.4.0-1092.103~18.04.1","5.4.0-1093.104~18.04.1","5.4.0-1094.105~18.04.1","5.4.0-1095.106~18.04.1","5.4.0-1096.107~18.04.1","5.4.0-1097.109~18.04.2","5.4.0-1098.110~18.04.2","5.4.0-1100.112~18.04.1","5.4.0-1101.113~18.04.1","5.4.0-1102.114~18.04.1","5.4.0-1103.115~18.04.1","5.4.0-1104.116~18.04.1","5.4.0-1105.117~18.04.1","5.4.0-1106.118~18.04.1","5.4.0-1107.119~18.04.1","5.4.0-1108.120~18.04.1","5.4.0-1109.121~18.04.1","5.4.0-1110.122~18.04.1","5.4.0-1111.123~18.04.1","5.4.0-1112.124~18.04.1","5.4.0-1114.126~18.04.1","5.4.0-1115.127~18.04.1","5.4.0-1116.128~18.04.1","5.4.0-1117.129~18.04.1","5.4.0-1118.130~18.04.1","5.4.0-1119.131~18.04.1","5.4.0-1120.132~18.04.1","5.4.0-1121.133~18.04.1","5.4.0-1122.134~18.04.1","5.4.0-1129.142~18.04.1","5.4.0-1130.143~18.04.1","5.4.0-1131.144~18.04.1","5.4.0-1132.145~18.04.1","5.4.0-1133.146~18.04.1","5.4.0-1134.147~18.04.1","5.4.0-1135.148~18.04.1","5.4.0-1136.149~18.04.1","5.4.0-1137.150~18.04.1","5.4.0-1139.152~18.04.1","5.4.0-1140.153~18.04.1","5.4.0-1143.156~18.04.1","5.4.0-1144.157~18.04.1","5.4.0-1145.158~18.04.1","5.4.0-1146.159~18.04.1","5.4.0-1147.160~18.04.1","5.4.0-1148.161~18.04.1","5.4.0-1149.162~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2000.4","4.15.0-2018.18","4.15.0-2021.21","4.15.0-2022.22","4.15.0-2024.24","4.15.0-2025.25","4.15.0-2026.26","4.15.0-2027.27","4.15.0-2030.31","4.15.0-2031.32","4.15.0-2033.34","4.15.0-2034.35","4.15.0-2035.37","4.15.0-2036.38","4.15.0-2037.39","4.15.0-2038.40","4.15.0-2039.41","4.15.0-2040.42","4.15.0-2041.43","4.15.0-2042.44","4.15.0-2044.46","4.15.0-2045.47","4.15.0-2048.50","4.15.0-2051.53","4.15.0-2052.54","4.15.0-2053.55","4.15.0-2054.56","4.15.0-2055.57","4.15.0-2056.58","4.15.0-2057.59","4.15.0-2059.61","4.15.0-2060.62","4.15.0-2061.63","4.15.0-2063.66","4.15.0-2064.67","4.15.0-2065.68","4.15.0-2066.69","4.15.0-2067.70","4.15.0-2069.72","4.15.0-2072.76","4.15.0-2075.80","4.15.0-2076.81","4.15.0-2078.83","4.15.0-2079.84","4.15.0-2080.85","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2083.89","4.15.0-2085.91","4.15.0-2087.93","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106","4.15.0-2101.107","4.15.0-2102.108","4.15.0-2103.109","4.15.0-2104.110","4.15.0-2105.111","4.15.0-2106.112","4.15.0-2107.113","4.15.0-2108.114","4.15.0-2109.115","4.15.0-2110.116","4.15.0-2111.117","4.15.0-2112.118","4.15.0-2113.119","4.15.0-2114.120","4.15.0-2115.121","4.15.0-2116.122","4.15.0-2117.123","4.15.0-2118.124","4.15.0-2119.125","4.15.0-2120.126","4.15.0-2121.127","4.15.0-2122.128","4.15.0-2123.129","4.15.0-2124.130","4.15.0-2125.131","4.15.0-2126.132","4.15.0-2127.133","4.15.0-2128.134","4.15.0-2129.135","4.15.0-2130.136","4.15.0-2132.138","4.15.0-2133.139","4.15.0-2134.140","4.15.0-2135.141","4.15.0-2136.142","4.15.0-2137.143"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-2006.7","4.15.0-2007.8","4.15.0-2008.9","4.15.0-2009.10","4.15.0-2012.14","4.15.0-2013.15","4.15.0-2015.17","4.15.0-2016.18","4.15.0-2017.20","4.15.0-2018.21","4.15.0-2020.23","4.15.0-2021.24","4.15.0-2022.25","4.15.0-2023.26","4.15.0-2024.27","4.15.0-2025.28","4.15.0-2026.29","4.15.0-2027.30","4.15.0-2030.33","4.15.0-2033.37","4.15.0-2034.38","4.15.0-2035.39","4.15.0-2036.40","4.15.0-2037.41","4.15.0-2038.42","4.15.0-2039.43","4.15.0-2041.45","4.15.0-2042.46","4.15.0-2043.47","4.15.0-2045.49","4.15.0-2046.50","4.15.0-2047.51","4.15.0-2048.52","4.15.0-2049.53","4.15.0-2050.54","4.15.0-2053.58","4.15.0-2056.62","4.15.0-2057.63","4.15.0-2059.65","4.15.0-2060.66","4.15.0-2062.68","4.15.0-2066.72","4.15.0-2067.73","4.15.0-2068.74","4.15.0-2070.76","4.15.0-2071.77","4.15.0-2072.78","4.15.0-2073.79","4.15.0-2074.80","4.15.0-2075.81","4.15.0-2076.82","4.15.0-2077.83","4.15.0-2078.84","4.15.0-2079.85","4.15.0-2080.86","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2084.90","4.15.0-2085.91","4.15.0-2086.92","4.15.0-2087.93","4.15.0-2088.94","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2091.97","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106","4.15.0-2101.107","4.15.0-2102.108","4.15.0-2104.110","4.15.0-2105.111","4.15.0-2106.112","4.15.0-2109.115","4.15.0-2110.116","4.15.0-2111.117","4.15.0-2112.118","4.15.0-2113.119","4.15.0-2114.120","4.15.0-2115.121","4.15.0-2116.122","4.15.0-2117.123"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1027.32","4.15.0-1029.34","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1037.42","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1040.45","4.15.0-1041.46","4.15.0-1044.50","4.15.0-1045.52","4.15.0-1046.53","4.15.0-1048.55","4.15.0-1049.56","4.15.0-1050.58","4.15.0-1051.59","4.15.0-1052.60","4.15.0-1053.61","4.15.0-1054.62","4.15.0-1055.63","4.15.0-1056.64","4.15.0-1057.65","4.15.0-1058.66","4.15.0-1059.67","4.15.0-1060.68","4.15.0-1063.71","4.15.0-1066.75","4.15.0-1067.76","4.15.0-1068.77","4.15.0-1069.78","4.15.0-1070.79","4.15.0-1071.80","4.15.0-1072.81","4.15.0-1073.82","4.15.0-1075.84","4.15.0-1076.85","4.15.0-1078.87","4.15.0-1080.89","4.15.0-1081.90","4.15.0-1083.92","4.15.0-1084.93","4.15.0-1085.94","4.15.0-1087.96","4.15.0-1090.100","4.15.0-1093.104","4.15.0-1094.105","4.15.0-1096.107","4.15.0-1097.108","4.15.0-1098.109","4.15.0-1099.110","4.15.0-1100.111","4.15.0-1103.114","4.15.0-1104.115","4.15.0-1105.116","4.15.0-1107.118","4.15.0-1108.119","4.15.0-1109.120","4.15.0-1110.121","4.15.0-1111.122","4.15.0-1112.123","4.15.0-1113.124","4.15.0-1114.125","4.15.0-1115.126","4.15.0-1116.127","4.15.0-1117.128","4.15.0-1118.129","4.15.0-1119.130","4.15.0-1121.132","4.15.0-1122.133","4.15.0-1123.134","4.15.0-1124.135","4.15.0-1125.136","4.15.0-1126.137","4.15.0-1127.138","4.15.0-1128.139","4.15.0-1129.140","4.15.0-1130.141","4.15.0-1131.142","4.15.0-1132.143","4.15.0-1133.144","4.15.0-1134.145","4.15.0-1135.146","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1138.149","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.153","4.15.0-1142.154","4.15.0-1143.155","4.15.0-1144.156","4.15.0-1145.157","4.15.0-1146.158","4.15.0-1147.159","4.15.0-1148.160","4.15.0-1149.161","4.15.0-1150.162","4.15.0-1151.163","4.15.0-1152.164","4.15.0-1153.165","4.15.0-1154.166"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2013.14","4.15.0-2016.18","4.15.0-2017.19","4.15.0-2018.20","4.15.0-2019.21","4.15.0-2020.22","4.15.0-2021.23","4.15.0-2022.24","4.15.0-2024.26","4.15.0-2025.27","4.15.0-2026.28","4.15.0-2028.31","4.15.0-2029.32","4.15.0-2030.33","4.15.0-2031.34","4.15.0-2032.35","4.15.0-2034.37","4.15.0-2037.41","4.15.0-2040.45","4.15.0-2041.46","4.15.0-2043.48","4.15.0-2044.49","4.15.0-2045.50","4.15.0-2047.52","4.15.0-2050.55","4.15.0-2052.57","4.15.0-2054.59","4.15.0-2055.60","4.15.0-2056.61","4.15.0-2057.62","4.15.0-2058.63","4.15.0-2059.64","4.15.0-2060.65","4.15.0-2061.66","4.15.0-2062.67","4.15.0-2063.68","4.15.0-2064.69","4.15.0-2065.70","4.15.0-2066.71","4.15.0-2067.72","4.15.0-2068.73","4.15.0-2069.74","4.15.0-2070.75","4.15.0-2071.76","4.15.0-2072.77","4.15.0-2073.78","4.15.0-2074.79","4.15.0-2075.80","4.15.0-2076.81","4.15.0-2077.83","4.15.0-2078.84","4.15.0-2079.85","4.15.0-2080.86","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2083.89","4.15.0-2084.90","4.15.0-2085.91","4.15.0-2086.92","4.15.0-2087.93","4.15.0-2088.94","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2091.97","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2000.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1011.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86","5.4.0-80.90","5.4.0-81.91","5.4.0-84.94","5.4.0-86.97","5.4.0-88.99","5.4.0-89.100","5.4.0-90.101","5.4.0-91.102","5.4.0-92.103","5.4.0-94.106","5.4.0-96.109","5.4.0-97.110","5.4.0-99.112","5.4.0-100.113","5.4.0-104.118","5.4.0-105.119","5.4.0-107.121","5.4.0-109.123","5.4.0-110.124","5.4.0-113.127","5.4.0-117.132","5.4.0-120.136","5.4.0-121.137","5.4.0-122.138","5.4.0-124.140","5.4.0-125.141","5.4.0-126.142","5.4.0-128.144","5.4.0-131.147","5.4.0-132.148","5.4.0-135.152","5.4.0-136.153","5.4.0-137.154","5.4.0-139.156","5.4.0-144.161","5.4.0-146.163","5.4.0-147.164","5.4.0-148.165","5.4.0-149.166","5.4.0-150.167","5.4.0-152.169","5.4.0-153.170","5.4.0-155.172","5.4.0-156.173","5.4.0-159.176","5.4.0-162.179","5.4.0-163.180","5.4.0-164.181","5.4.0-165.182","5.4.0-166.183","5.4.0-167.184","5.4.0-169.187","5.4.0-170.188","5.4.0-171.189","5.4.0-172.190","5.4.0-173.191","5.4.0-174.193","5.4.0-176.196","5.4.0-177.197","5.4.0-181.201","5.4.0-182.202","5.4.0-186.206","5.4.0-187.207","5.4.0-189.209","5.4.0-190.210","5.4.0-192.212","5.4.0-193.213","5.4.0-195.215","5.4.0-196.216","5.4.0-198.218","5.4.0-200.220","5.4.0-202.222","5.4.0-204.224","5.4.0-205.225","5.4.0-208.228","5.4.0-211.231","5.4.0-212.232","5.4.0-214.234","5.4.0-215.235","5.4.0-216.236","5.4.0-218.238","5.4.0-219.239","5.4.0-220.240","5.4.0-221.241","5.4.0-222.242","5.4.0-223.243","5.4.0-224.244","5.4.0-225.245","5.4.0-227.247","5.4.0-228.248","5.4.0-229.249","5.4.0-230.250","5.4.0-231.251","5.4.0-233.253","5.4.0-234.254","5.4.0-238.258","5.4.0-241.261","5.4.0-242.262","5.4.0-244.264","5.4.0-245.265"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.3.0-1010.11","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1017.17","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.37","5.4.0-1037.39","5.4.0-1038.40","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1045.47","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1088.96","5.4.0-1089.97","5.4.0-1092.100","5.4.0-1093.101","5.4.0-1094.102","5.4.0-1096.104","5.4.0-1097.105","5.4.0-1099.107","5.4.0-1100.108","5.4.0-1101.109","5.4.0-1102.110","5.4.0-1103.111","5.4.0-1104.112","5.4.0-1105.113","5.4.0-1106.114","5.4.0-1107.115","5.4.0-1108.116","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.123","5.4.0-1114.124","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133","5.4.0-1124.134","5.4.0-1125.135","5.4.0-1126.136","5.4.0-1127.137","5.4.0-1128.138","5.4.0-1129.139","5.4.0-1130.140","5.4.0-1131.141","5.4.0-1132.142","5.4.0-1133.143","5.4.0-1134.144","5.4.0-1135.145","5.4.0-1136.146","5.4.0-1137.147","5.4.0-1139.149","5.4.0-1140.150","5.4.0-1142.152","5.4.0-1144.154","5.4.0-1145.155","5.4.0-1146.156","5.4.0-1147.157","5.4.0-1148.158","5.4.0-1149.159","5.4.0-1150.160","5.4.0-1151.161","5.4.0-1152.162","5.4.0-1153.163","5.4.0-1154.164","5.4.0-1156.166","5.4.0-1157.167","5.4.0-1158.168","5.4.0-1159.169","5.4.0-1160.170","5.4.0-1161.172","5.4.0-1162.173","5.4.0-1163.174","5.4.0-1164.175","5.4.0-1165.176","5.4.0-1166.177","5.4.0-1167.178"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124~20.04.1"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1075.82~20.04.1","5.15.0-1077.84~20.04.1","5.15.0-1080.87~20.04.1","5.15.0-1081.88~20.04.1","5.15.0-1082.89~20.04.1","5.15.0-1083.90~20.04.1","5.15.0-1084.91~20.04.1","5.15.0-1086.93~20.04.1","5.15.0-1087.94~20.04.1","5.15.0-1088.95~20.04.1","5.15.0-1089.96~20.04.1","5.15.0-1090.97~20.04.1","5.15.0-1091.98~20.04.1","5.15.0-1092.99~20.04.1","5.15.0-1093.100~20.04.1","5.15.0-1095.102~20.04.1","5.15.0-1096.103~20.04.1","5.15.0-1097.104~20.04.1","5.15.0-1098.105~20.04.1","5.15.0-1099.106~20.04.1","5.15.0-1100.107~20.04.2","5.15.0-1101.108~20.04.1","5.15.0-1103.110~20.04.1","5.15.0-1104.111~20.04.1","5.15.0-1105.112~20.04.1","5.15.0-1106.113~20.04.1","5.15.0-1108.115~20.04.1","5.15.0-1109.116~20.04.1","5.15.0-1111.118~20.04.1","5.15.0-1112.119~20.04.1","5.15.0-1114.121~20.04.1","5.15.0-1115.122~20.04.1","5.15.0-1116.123~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1006.6","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1010.10","5.4.0-1012.12","5.4.0-1016.16","5.4.0-1019.19","5.4.0-1020.20","5.4.0-1022.22","5.4.0-1023.23","5.4.0-1025.25","5.4.0-1026.26","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.38","5.4.0-1039.41","5.4.0-1040.42","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1072.75","5.4.0-1073.76","5.4.0-1074.77","5.4.0-1077.80","5.4.0-1078.81","5.4.0-1080.83","5.4.0-1083.87","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1098.104","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1103.109","5.4.0-1104.110","5.4.0-1105.111","5.4.0-1106.112","5.4.0-1107.113","5.4.0-1108.114","5.4.0-1109.115","5.4.0-1110.116","5.4.0-1111.117","5.4.0-1112.118","5.4.0-1113.119","5.4.0-1114.120","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1122.129","5.4.0-1123.130","5.4.0-1124.131","5.4.0-1126.133","5.4.0-1127.134","5.4.0-1128.135","5.4.0-1129.136","5.4.0-1130.137","5.4.0-1131.138","5.4.0-1132.139","5.4.0-1133.140","5.4.0-1134.141","5.4.0-1135.142","5.4.0-1136.143","5.4.0-1137.144","5.4.0-1138.145","5.4.0-1139.146","5.4.0-1140.147","5.4.0-1142.149","5.4.0-1143.150","5.4.0-1145.152","5.4.0-1147.154","5.4.0-1148.155","5.4.0-1149.156","5.4.0-1150.157","5.4.0-1151.158","5.4.0-1152.159","5.4.0-1153.160","5.4.0-1154.161","5.4.0-1156.163","5.4.0-1157.164","5.4.0-1160.166","5.4.0-1161.167","5.4.0-1162.168","5.4.0-1163.169","5.4.0-1164.170","5.4.0-1166.172","5.4.0-1167.173","5.4.0-1168.174","5.4.0-1169.175","5.4.0-1170.176","5.4.0-1171.177","5.4.0-1172.178"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132~20.04.1"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1","5.15.0-1063.72~20.04.1","5.15.0-1064.73~20.04.1","5.15.0-1065.74~20.04.1","5.15.0-1067.76~20.04.1","5.15.0-1068.77~20.04.1","5.15.0-1070.79~20.04.1","5.15.0-1071.80~20.04.1","5.15.0-1072.81~20.04.1","5.15.0-1073.82~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1079.88~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1082.91~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.1","5.15.0-1088.97~20.04.1","5.15.0-1089.98~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1094.103~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1102.111~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1110.119~20.04.1","5.15.0-1111.120~20.04.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1122.131~20.04.1"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.10","5.4.0-1011.14","5.4.0-1012.15","5.4.0-1013.16","5.4.0-1016.19","5.4.0-1019.22","5.4.0-1020.23","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1040.44","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1049.55","5.4.0-1050.56","5.4.0-1054.60","5.4.0-1058.64","5.4.0-1059.65","5.4.0-1060.66","5.4.0-1062.68","5.4.0-1064.70","5.4.0-1065.71","5.4.0-1066.72","5.4.0-1068.74","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1072.78","5.4.0-1073.79","5.4.0-1074.80","5.4.0-1075.81","5.4.0-1076.82","5.4.0-1077.83","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1082.89","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1088.95","5.4.0-1089.96","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1092.99","5.4.0-1093.100","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118","5.4.0-1112.119","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1123.130","5.4.0-1125.132","5.4.0-1126.133"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1004.4","5.3.0-1009.10","5.3.0-1011.12","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1033.35","5.4.0-1034.37","5.4.0-1036.39","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1040.43","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1044.47","5.4.0-1046.49","5.4.0-1049.53","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1060.64","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.94","5.4.0-1087.95","5.4.0-1089.97","5.4.0-1090.98","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1096.105","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136","5.4.0-1128.137","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1139.148","5.4.0-1140.149","5.4.0-1141.150","5.4.0-1142.151","5.4.0-1143.152","5.4.0-1145.154","5.4.0-1146.155","5.4.0-1147.156","5.4.0-1148.157","5.4.0-1149.158","5.4.0-1150.159","5.4.0-1151.160","5.4.0-1152.161","5.4.0-1153.162","5.4.0-1154.163","5.4.0-1155.164","5.4.0-1156.165","5.4.0-1157.166","5.4.0-1159.168","5.4.0-1160.169","5.4.0-1161.170","5.4.0-1162.171","5.4.0-1163.172","5.4.0-1164.173","5.4.0-1165.174","5.4.0-1166.175","5.4.0-1167.177","5.4.0-1168.178","5.4.0-1169.179","5.4.0-1170.180"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128~20.04.1"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1","5.15.0-1059.67~20.04.1","5.15.0-1060.68~20.04.1","5.15.0-1062.70~20.04.1","5.15.0-1065.73~20.04.1","5.15.0-1066.74~20.04.1","5.15.0-1067.75~20.04.1","5.15.0-1068.76~20.04.1","5.15.0-1069.77~20.04.1","5.15.0-1070.78~20.04.1","5.15.0-1071.79~20.04.1","5.15.0-1072.80~20.04.1","5.15.0-1073.81~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1077.86~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1083.92~20.04.1","5.15.0-1085.94~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.2","5.15.0-1088.97~20.04.1","5.15.0-1090.99~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1092.101~20.04.1","5.15.0-1093.102~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1099.108~20.04.1","5.15.0-1100.109~20.04.1","5.15.0-1101.110~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1104.113~20.04.1","5.15.0-1106.115~20.04.1","5.15.0-1108.117~20.04.1","5.15.0-1109.118~20.04.1","5.15.0-1111.121~20.04.1","5.15.0-1112.122~20.04.1","5.15.0-1114.124~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-130.140~20.04.1","5.15.0-131.141~20.04.1","5.15.0-134.145~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-151.161~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.3","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-176.186~20.04.1","5.15.0-177.187~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-185.195~20.04.1","5.15.0-186.196~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1003.4","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1006.7","5.4.0-1007.8","5.4.0-1008.9","5.4.0-1010.11","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1017.19","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1020.22","5.4.0-1021.23","5.4.0-1023.25","5.4.0-1026.29","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1036.41","5.4.0-1037.42","5.4.0-1040.45","5.4.0-1041.46","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1049.54","5.4.0-1050.55","5.4.0-1051.56","5.4.0-1052.57","5.4.0-1053.58","5.4.0-1054.59","5.4.0-1056.61","5.4.0-1057.62","5.4.0-1058.63","5.4.0-1059.64","5.4.0-1060.65","5.4.0-1061.66","5.4.0-1063.68","5.4.0-1064.69","5.4.0-1065.70","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1068.73","5.4.0-1069.74","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1077.82","5.4.0-1078.83","5.4.0-1079.84","5.4.0-1080.85","5.4.0-1081.86","5.4.0-1082.87","5.4.0-1083.88","5.4.0-1084.89","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1088.93","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1092.97","5.4.0-1093.98","5.4.0-1094.99","5.4.0-1095.100","5.4.0-1096.101","5.4.0-1097.102","5.4.0-1098.103","5.4.0-1099.104","5.4.0-1100.105","5.4.0-1102.107","5.4.0-1103.108","5.4.0-1104.109","5.4.0-1105.110","5.4.0-1107.112","5.4.0-1108.113","5.4.0-1109.114","5.4.0-1111.116","5.4.0-1112.117","5.4.0-1113.118"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1111.115~20.04.1"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1","5.15.0-1054.57~20.04.1","5.15.0-1055.58~20.04.1","5.15.0-1057.60~20.04.1","5.15.0-1058.61~20.04.1","5.15.0-1059.62~20.04.1","5.15.0-1060.63~20.04.1","5.15.0-1061.64~20.04.1","5.15.0-1062.65~20.04.1","5.15.0-1063.66~20.04.1","5.15.0-1064.67~20.04.1","5.15.0-1065.68~20.04.1","5.15.0-1066.69~20.04.1","5.15.0-1067.70~20.04.1","5.15.0-1068.71~20.04.1","5.15.0-1069.72~20.04.1","5.15.0-1074.77~20.04.1","5.15.0-1075.78~20.04.1","5.15.0-1076.79~20.04.1","5.15.0-1078.81~20.04.1","5.15.0-1079.82~20.04.1","5.15.0-1080.83~20.04.1","5.15.0-1081.84~20.04.1","5.15.0-1083.86~20.04.1","5.15.0-1085.88~20.04.1","5.15.0-1086.89~20.04.1","5.15.0-1087.90~20.04.1","5.15.0-1089.92~20.04.1","5.15.0-1090.93~20.04.1","5.15.0-1091.94~20.04.1","5.15.0-1092.95~20.04.1","5.15.0-1093.96~20.04.1","5.15.0-1094.97~20.04.1","5.15.0-1095.98~20.04.1","5.15.0-1097.100~20.04.1","5.15.0-1098.101~20.04.1","5.15.0-1099.102~20.04.1","5.15.0-1100.103~20.04.1","5.15.0-1102.105~20.04.1","5.15.0-1103.106~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.118~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1060.66~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.2","5.15.0-1074.80~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.1","5.15.0-1086.92~20.04.1","5.15.0-1087.93~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1099.105~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1103.109~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1107.113~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-iot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.3","5.4.0-1004.6","5.4.0-1005.7","5.4.0-1006.8","5.4.0-1009.11","5.4.0-1010.12","5.4.0-1011.13","5.4.0-1012.14","5.4.0-1013.15","5.4.0-1014.16","5.4.0-1017.18","5.4.0-1018.19","5.4.0-1019.20","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1042.43","5.4.0-1043.44","5.4.0-1044.45","5.4.0-1045.46","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1071.74"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1004.4","5.4.0-1006.6","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1023.23","5.4.0-1024.24","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1044.46","5.4.0-1045.47","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1050.52","5.4.0-1051.53","5.4.0-1053.55","5.4.0-1054.56","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1068.72","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1082.88","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.92","5.4.0-1087.93","5.4.0-1088.94","5.4.0-1089.95","5.4.0-1090.96","5.4.0-1091.97","5.4.0-1092.98","5.4.0-1093.99","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1096.102","5.4.0-1097.103","5.4.0-1098.104","5.4.0-1099.105","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1102.108","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118","5.4.0-1112.119","5.4.0-1113.120","5.4.0-1114.121","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.127","5.4.0-1120.128","5.4.0-1121.129","5.4.0-1122.130","5.4.0-1123.131","5.4.0-1124.132","5.4.0-1125.133","5.4.0-1126.134","5.4.0-1127.136","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1139.148","5.4.0-1140.149","5.4.0-1141.150","5.4.0-1143.152","5.4.0-1144.153","5.4.0-1145.154","5.4.0-1146.155","5.4.0-1147.156","5.4.0-1148.157","5.4.0-1149.158","5.4.0-1150.159","5.4.0-1151.160","5.4.0-1152.161","5.4.0-1153.162","5.4.0-1154.163"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-195.205~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-110.120~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-128.138~20.04.1","5.15.0-129.139~20.04.1","5.15.0-131.141~20.04.1","5.15.0-133.143~20.04.1","5.15.0-134.145~20.04.1","5.15.0-135.146~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-140.150~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.1","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-174.184~20.04.1","5.15.0-175.185~20.04.1","5.15.0-177.187~20.04.1","5.15.0-178.188~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-183.193~20.04.1","5.15.0-184.194~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-nvidia-tegra-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1070.72~20.04.1"}]}],"versions":["5.15.0-1009.9~20.04.1","5.15.0-1010.10~20.04.1","5.15.0-1012.12~20.04.1","5.15.0-1014.14~20.04.1","5.15.0-1015.15~20.04.1","5.15.0-1016.16~20.04.1","5.15.0-1017.17~20.04.1","5.15.0-1018.18~20.04.1","5.15.0-1019.19~20.04.1","5.15.0-1020.20~20.04.1","5.15.0-1022.22~20.04.1","5.15.0-1025.25~20.04.1","5.15.0-1027.27~20.04.1","5.15.0-1030.30~20.04.1","5.15.0-1032.32~20.04.1","5.15.0-1039.39~20.04.1","5.15.0-1040.40~20.04.1","5.15.0-1041.41~20.04.1","5.15.0-1042.42~20.04.1","5.15.0-1043.43~20.04.1","5.15.0-1044.44~20.04.1","5.15.0-1045.45~20.04.1","5.15.0-1046.46~20.04.1","5.15.0-1047.47~20.04.1","5.15.0-1048.48~20.04.1","5.15.0-1049.49~20.04.1","5.15.0-1050.50~20.04.1","5.15.0-1051.51~20.04.1","5.15.0-1052.52~20.04.2","5.15.0-1053.53~20.04.1","5.15.0-1055.55~20.04.1","5.15.0-1057.57~20.04.1","5.15.0-1058.58~20.04.1","5.15.0-1060.60~20.04.1","5.15.0-1061.61~20.04.1","5.15.0-1063.63~20.04.1","5.15.0-1064.66~20.04.1","5.15.0-1065.67~20.04.1","5.15.0-1066.68~20.04.1","5.15.0-1067.69~20.04.1","5.15.0-1068.70~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1002.2","5.3.0-1007.8","5.3.0-1008.9","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1034.36","5.4.0-1035.38","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1039.42","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1069.75","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1073.79","5.4.0-1076.83","5.4.0-1078.86","5.4.0-1079.87","5.4.0-1081.89","5.4.0-1082.90","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1090.99","5.4.0-1091.100","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1094.103","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1099.108","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1119.128","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1140.150","5.4.0-1141.151","5.4.0-1142.152","5.4.0-1143.153","5.4.0-1144.154","5.4.0-1145.155","5.4.0-1146.156","5.4.0-1147.157","5.4.0-1149.159","5.4.0-1150.160","5.4.0-1151.161","5.4.0-1152.162","5.4.0-1154.164","5.4.0-1155.165","5.4.0-1156.166","5.4.0-1157.167","5.4.0-1158.168","5.4.0-1159.169","5.4.0-1160.170","5.4.0-1161.171","5.4.0-1162.172","5.4.0-1163.173","5.4.0-1164.174","5.4.0-1165.175"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1114.120~20.04.1"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1074.80~20.04.1","5.15.0-1075.81~20.04.1","5.15.0-1076.82~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1080.86~20.04.1","5.15.0-1081.87~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.3","5.15.0-1086.92~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1097.103~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1102.108~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.7","5.4.0-1008.8","5.4.0-1011.11","5.4.0-1012.12","5.4.0-1013.13","5.4.0-1015.15","5.4.0-1016.17","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1029.32","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1033.36","5.4.0-1034.37","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1038.41","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1050.56","5.4.0-1052.58","5.4.0-1053.60","5.4.0-1055.62","5.4.0-1056.63","5.4.0-1058.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1062.70","5.4.0-1065.75","5.4.0-1066.76","5.4.0-1068.78","5.4.0-1069.79","5.4.0-1070.80","5.4.0-1071.81","5.4.0-1073.84","5.4.0-1074.85","5.4.0-1077.88","5.4.0-1078.89","5.4.0-1079.90","5.4.0-1080.91","5.4.0-1081.92","5.4.0-1082.93","5.4.0-1083.94","5.4.0-1084.95","5.4.0-1085.96","5.4.0-1086.97","5.4.0-1088.99","5.4.0-1089.100","5.4.0-1090.101","5.4.0-1091.102","5.4.0-1092.103","5.4.0-1093.104","5.4.0-1094.105","5.4.0-1095.106","5.4.0-1096.107","5.4.0-1097.109","5.4.0-1098.110","5.4.0-1100.112","5.4.0-1101.113","5.4.0-1102.114","5.4.0-1103.115","5.4.0-1104.116","5.4.0-1105.117","5.4.0-1106.118","5.4.0-1107.119","5.4.0-1108.120","5.4.0-1109.121","5.4.0-1110.122","5.4.0-1111.123","5.4.0-1112.124","5.4.0-1113.125","5.4.0-1114.126","5.4.0-1115.127","5.4.0-1116.128","5.4.0-1117.129","5.4.0-1118.130","5.4.0-1119.131","5.4.0-1120.132","5.4.0-1121.133","5.4.0-1122.134","5.4.0-1129.142","5.4.0-1130.143","5.4.0-1131.144","5.4.0-1132.145","5.4.0-1133.146","5.4.0-1134.147","5.4.0-1135.148","5.4.0-1136.149","5.4.0-1137.150","5.4.0-1139.152","5.4.0-1140.153","5.4.0-1143.156","5.4.0-1144.157","5.4.0-1145.158","5.4.0-1146.159","5.4.0-1147.160","5.4.0-1148.161","5.4.0-1149.162"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-riscv-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1111.115~20.04.1"}]}],"versions":["5.15.0-1015.17~20.04.1","5.15.0-1017.19~20.04.1","5.15.0-1018.21~20.04.1","5.15.0-1019.22~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1029.33~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1032.36~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.2","5.15.0-1037.41~20.04.2","5.15.0-1038.42~20.04.2","5.15.0-1039.43~20.04.2","5.15.0-1040.44~20.04.3","5.15.0-1041.45~20.04.1","5.15.0-1043.47~20.04.1","5.15.0-1044.48~20.04.1","5.15.0-1045.49~20.04.1","5.15.0-1046.50~20.04.1","5.15.0-1047.51~20.04.1","5.15.0-1048.52~20.04.1","5.15.0-1049.53~20.04.2","5.15.0-1050.54~20.04.1","5.15.0-1051.55~20.04.1","5.15.0-1052.56~20.04.1","5.15.0-1053.57~20.04.1","5.15.0-1056.60~20.04.1","5.15.0-1057.61~20.04.1","5.15.0-1058.62~20.04.1","5.15.0-1059.63~20.04.1","5.15.0-1060.64~20.04.1","5.15.0-1061.65~20.04.1","5.15.0-1062.66~20.04.1","5.15.0-1063.67~20.04.1","5.15.0-1064.68~20.04.1","5.15.0-1065.69~20.04.1","5.15.0-1066.70~20.04.1","5.15.0-1067.71~20.04.1","5.15.0-1068.72~20.04.1","5.15.0-1069.73~20.04.1","5.15.0-1070.74~20.04.1","5.15.0-1071.75~20.04.1","5.15.0-1072.76~20.04.1","5.15.0-1073.77~20.04.1","5.15.0-1074.78~20.04.1","5.15.0-1075.79~20.04.1","5.15.0-1076.80~20.04.1","5.15.0-1077.81~20.04.1","5.15.0-1078.82~20.04.1","5.15.0-1079.83~20.04.1","5.15.0-1081.85~20.04.1","5.15.0-1082.86~20.04.1","5.15.0-1083.87~20.04.1","5.15.0-1084.88~20.04.1","5.15.0-1085.89~20.04.1","5.15.0-1086.90~20.04.1","5.15.0-1087.91~20.04.1","5.15.0-1088.92~20.04.1","5.15.0-1090.94~20.04.1","5.15.0-1091.95~20.04.1","5.15.0-1092.96~20.04.1","5.15.0-1093.97~20.04.2","5.15.0-1094.98~20.04.1","5.15.0-1095.99~20.04.1","5.15.0-1096.100~20.04.1","5.15.0-1097.101~20.04.1","5.15.0-1098.102~20.04.1","5.15.0-1099.103~20.04.1","5.15.0-1100.104~20.04.1","5.15.0-1102.106~20.04.1","5.15.0-1103.107~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1020.24","5.4.0-1021.25","5.4.0-1022.26","5.4.0-1023.27","5.4.0-1024.28","5.4.0-1025.29","5.4.0-1026.30","5.4.0-1027.31","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1030.34","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1035.39","5.4.0-1036.40","5.4.0-1037.41","5.4.0-1038.42","5.4.0-1039.43","5.4.0-1040.44","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.51","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1050.54","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1058.62","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1082.86","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2","5.4.0-1069.73+fips2","5.4.0-1071.76+fips1","5.4.0-1072.77+fips1","5.4.0-1073.78+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1083.90+fips1","5.4.0-1085.92+fips1","5.4.0-1086.93+fips1","5.4.0-1088.96+fips1","5.4.0-1089.97+fips1","5.4.0-1092.100+fips1","5.4.0-1093.101+fips1","5.4.0-1094.102+fips1","5.4.0-1096.104+fips1","5.4.0-1099.107+fips1","5.4.0-1100.108+fips1","5.4.0-1101.109+fips1","5.4.0-1102.110+fips1","5.4.0-1103.111+fips1","5.4.0-1104.112+fips1","5.4.0-1105.113+fips1","5.4.0-1106.114+fips1","5.4.0-1107.115+fips1","5.4.0-1108.116+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.123+fips1","5.4.0-1114.124+fips1","5.4.0-1116.126+fips1","5.4.0-1117.127+fips1","5.4.0-1118.128+fips1","5.4.0-1119.129+fips1","5.4.0-1120.130+fips1","5.4.0-1121.131+fips1","5.4.0-1122.132+fips1","5.4.0-1123.133+fips1","5.4.0-1124.134+fips1","5.4.0-1125.135+fips1","5.4.0-1126.136+fips2","5.4.0-1127.137+fips1","5.4.0-1128.138+fips1","5.4.0-1129.139+fips1","5.4.0-1130.140+fips1","5.4.0-1131.141+fips1","5.4.0-1132.142+fips1","5.4.0-1133.143+fips1","5.4.0-1134.144+fips1","5.4.0-1135.145+fips1","5.4.0-1136.146+fips1","5.4.0-1137.147+fips1","5.4.0-1139.149+fips1","5.4.0-1140.151+fips1","5.4.0-1142.153+fips1","5.4.0-1144.155+fips1","5.4.0-1145.156+fips1","5.4.0-1146.156+fips1","5.4.0-1147.157+fips1","5.4.0-1148.158+fips1","5.4.0-1149.159+fips1","5.4.0-1150.160+fips1","5.4.0-1151.161+fips1","5.4.0-1152.162+fips1","5.4.0-1153.163+fips1","5.4.0-1154.164+fips1","5.4.0-1155.165+fips1","5.4.0-1156.166+fips1","5.4.0-1157.167+fips1","5.4.0-1158.168+fips1","5.4.0-1159.169+fips1","5.4.0-1160.170+fips1","5.4.0-1161.172+fips1","5.4.0-1163.174+fips1","5.4.0-1165.176+fips1","5.4.0-1166.177+fips1","5.4.0-1167.178+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1","5.4.0-1073.76+fips1","5.4.0-1074.77+fips1","5.4.0-1076.79+fips1","5.4.0-1078.81+fips1","5.4.0-1080.83+fips1","5.4.0-1083.87+fips1","5.4.0-1085.90+fips1","5.4.0-1086.91+fips1","5.4.0-1089.94+fips1","5.4.0-1090.95+fips1","5.4.0-1091.96+fips1","5.4.0-1094.100+fips1","5.4.0-1095.101+fips1","5.4.0-1098.104+fips1","5.4.0-1100.106+fips1","5.4.0-1101.107+fips1","5.4.0-1103.109+fips1","5.4.0-1104.110+fips1","5.4.0-1105.111+fips1","5.4.0-1106.112+fips1","5.4.0-1107.113+fips1","5.4.0-1108.114+fips1","5.4.0-1109.115+fips1","5.4.0-1110.116+fips1","5.4.0-1111.117+fips1","5.4.0-1112.118+fips1","5.4.0-1113.119+fips1","5.4.0-1114.120+fips1","5.4.0-1115.122+fips1","5.4.0-1116.123+fips1","5.4.0-1117.124+fips1","5.4.0-1118.125+fips1","5.4.0-1119.126+fips1","5.4.0-1121.128+fips1","5.4.0-1122.129+fips1","5.4.0-1123.130+fips1","5.4.0-1124.131+fips1","5.4.0-1126.133+fips1","5.4.0-1127.134+fips1","5.4.0-1128.135+fips1","5.4.0-1129.136+fips1","5.4.0-1130.137+fips1","5.4.0-1131.138+fips1","5.4.0-1132.139+fips1","5.4.0-1133.140+fips1","5.4.0-1134.141+fips1","5.4.0-1135.142+fips1","5.4.0-1136.143+fips1","5.4.0-1137.144+fips1","5.4.0-1138.145+fips1","5.4.0-1139.146+fips1","5.4.0-1140.147+fips1","5.4.0-1142.149+fips1","5.4.0-1143.150+fips1","5.4.0-1145.152+fips1","5.4.0-1147.154+fips1","5.4.0-1148.156+fips1","5.4.0-1149.157+fips1","5.4.0-1151.158+fips1","5.4.0-1152.159+fips1","5.4.0-1153.160+fips1","5.4.0-1154.161+fips1","5.4.0-1155.162+fips1","5.4.0-1157.164+fips1","5.4.0-1158.165+fips1","5.4.0-1160.166+fips1","5.4.0-1161.167+fips1","5.4.0-1162.168+fips1","5.4.0-1163.169+fips1","5.4.0-1164.170+fips1","5.4.0-1166.172+fips1","5.4.0-1167.173+fips1","5.4.0-1168.174+fips1","5.4.0-1170.176+fips1","5.4.0-1171.177+fips1","5.4.0-1172.178+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1026.30","5.4.0-1028.32","5.4.0-1031.36","5.4.0-1032.37","5.4.0-1033.38","5.4.0-1034.40","5.4.0-1035.41","5.4.0-1036.42","5.4.0-1037.43","5.4.0-1038.44","5.4.0-1040.46","5.4.0-1041.47","5.4.0-1042.48","5.4.0-1043.49","5.4.0-1045.51","5.4.0-1046.52","5.4.0-1047.53","5.4.0-1048.54","5.4.0-1049.55","5.4.0-1051.57","5.4.0-1054.61","5.4.0-1056.64","5.4.0-1057.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1061.69","5.4.0-1062.70","5.4.0-1064.73","5.4.0-1065.74","5.4.0-1068.77","5.4.0-1069.78","5.4.0-1070.79","5.4.0-1072.81","5.4.0-1073.82","5.4.0-1074.83","5.4.0-1075.84","5.4.0-1076.85","5.4.0-1077.86","5.4.0-1078.87","5.4.0-1079.88","5.4.0-1080.89","5.4.0-1081.90","5.4.0-1082.91","5.4.0-1083.92","5.4.0-1084.93","5.4.0-1085.94","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1088.97","5.4.0-1089.98","5.4.0-1090.100","5.4.0-1091.101","5.4.0-1092.102","5.4.0-1094.104","5.4.0-1095.105","5.4.0-1096.106","5.4.0-1097.107","5.4.0-1098.108","5.4.0-1099.109","5.4.0-1100.110","5.4.0-1101.111","5.4.0-1102.112","5.4.0-1103.113","5.4.0-1104.114","5.4.0-1105.115","5.4.0-1106.116","5.4.0-1107.117","5.4.0-1108.118","5.4.0-1109.119","5.4.0-1110.120","5.4.0-1111.121","5.4.0-1112.122","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133","5.4.0-1124.134","5.4.0-1125.135","5.4.0-1126.136","5.4.0-1127.137","5.4.0-1128.138","5.4.0-1130.140","5.4.0-1131.141","5.4.0-1132.142","5.4.0-1133.143","5.4.0-1134.144","5.4.0-1135.145","5.4.0-1136.146","5.4.0-1137.147","5.4.0-1138.148","5.4.0-1139.149","5.4.0-1140.150","5.4.0-1141.151"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1","5.4.0-1067.71~20.04.1","5.4.0-1069.73+fips2","5.4.0-1071.75+fips1","5.4.0-1073.78+fips1","5.4.0-1075.80+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1086.94+fips1","5.4.0-1087.95+fips1","5.4.0-1089.97+fips1","5.4.0-1092.101+fips1","5.4.0-1093.102+fips1","5.4.0-1096.105+fips1","5.4.0-1097.106+fips1","5.4.0-1098.107+fips1","5.4.0-1100.109+fips1","5.4.0-1101.110+fips1","5.4.0-1102.111+fips1","5.4.0-1103.112+fips1","5.4.0-1104.113+fips1","5.4.0-1105.114+fips1","5.4.0-1106.115+fips1","5.4.0-1107.116+fips1","5.4.0-1108.117+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.122+fips1","5.4.0-1115.124+fips1","5.4.0-1116.125+fips1","5.4.0-1117.126+fips1","5.4.0-1118.127+fips1","5.4.0-1120.129+fips1","5.4.0-1121.130+fips1","5.4.0-1122.131+fips1","5.4.0-1124.133+fips1","5.4.0-1125.134+fips1","5.4.0-1126.135+fips1","5.4.0-1127.136+fips1","5.4.0-1128.137+fips1","5.4.0-1129.138+fips1","5.4.0-1130.139+fips1","5.4.0-1131.140+fips1","5.4.0-1132.141+fips1","5.4.0-1133.142+fips1","5.4.0-1134.143+fips1","5.4.0-1135.144+fips1","5.4.0-1136.145+fips1","5.4.0-1137.146+fips1","5.4.0-1138.147+fips1","5.4.0-1139.148+fips1","5.4.0-1140.149+fips1","5.4.0-1141.150+fips1","5.4.0-1142.151+fips1","5.4.0-1143.152+fips1","5.4.0-1145.154+fips1","5.4.0-1146.155+fips1","5.4.0-1147.156+fips1","5.4.0-1148.157+fips1","5.4.0-1149.158+fips1","5.4.0-1150.159+fips1","5.4.0-1151.160+fips1","5.4.0-1152.161+fips1","5.4.0-1153.162+fips1","5.4.0-1154.163+fips1","5.4.0-1155.164+fips1","5.4.0-1156.165+fips1","5.4.0-1157.166+fips1","5.4.0-1159.168+fips1","5.4.0-1160.169+fips1","5.4.0-1161.170+fips1","5.4.0-1162.171+fips1","5.4.0-1163.172+fips1","5.4.0-1164.173+fips1","5.4.0-1165.174+fips1","5.4.0-1166.175+fips1","5.4.0-1167.176+fips1","5.4.0-1168.178+fips1","5.4.0-1169.179+fips1","5.4.0-1170.180+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-112.122","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-130.140","5.15.0-131.141","5.15.0-133.144","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-151.161","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-176.186","5.15.0-177.187","5.15.0-179.189","5.15.0-181.191","5.15.0-185.195","5.15.0-186.196","5.15.0-187.197","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1076.83","5.15.0-1078.85","5.15.0-1079.86","5.15.0-1080.87","5.15.0-1081.88","5.15.0-1082.89","5.15.0-1083.90","5.15.0-1084.91","5.15.0-1085.92","5.15.0-1086.93","5.15.0-1087.94","5.15.0-1088.95","5.15.0-1089.96","5.15.0-1090.97","5.15.0-1091.98","5.15.0-1092.99","5.15.0-1093.100","5.15.0-1095.102","5.15.0-1096.103","5.15.0-1097.104","5.15.0-1098.105","5.15.0-1099.106","5.15.0-1100.107","5.15.0-1101.108","5.15.0-1103.110","5.15.0-1104.111","5.15.0-1105.112","5.15.0-1106.113","5.15.0-1108.115","5.15.0-1109.116","5.15.0-1111.118","5.15.0-1112.119","5.15.0-1113.120","5.15.0-1114.121","5.15.0-1115.122","5.15.0-1116.123"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1057.60~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.2","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1","6.8.0-1065.68~22.04.1","6.8.0-1066.69~22.04.1","6.8.0-1069.74~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70","5.15.0-1063.72","5.15.0-1064.73","5.15.0-1066.75","5.15.0-1067.76","5.15.0-1068.77","5.15.0-1070.79","5.15.0-1071.80","5.15.0-1072.81","5.15.0-1073.82","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1084.93","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1101.110","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1109.118","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1121.130","5.15.0-1122.131"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1","6.8.0-1059.65~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.71~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1068.76~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.82~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1122.131"}]}],"versions":["5.15.0-1019.24.1","5.15.0-1024.30.1","5.15.0-1029.36.1","5.15.0-1030.37.1","5.15.0-1031.38.1","5.15.0-1033.40.1","5.15.0-1034.41.1","5.15.0-1035.42.1","5.15.0-1036.43.1","5.15.0-1037.44.1","5.15.0-1038.45.1","5.15.0-1039.46.1","5.15.0-1041.48.1","5.15.0-1042.49.1","5.15.0-1044.51.1","5.15.0-1045.52.1","5.15.0-1046.53.1","5.15.0-1047.54.1","5.15.0-1049.56.1","5.15.0-1050.57.1","5.15.0-1051.59.1","5.15.0-1052.60.1","5.15.0-1053.61.1","5.15.0-1054.62.1","5.15.0-1056.64.1","5.15.0-1057.65.1","5.15.0-1058.66.1","5.15.0-1059.67.1","5.15.0-1060.69.1","5.15.0-1061.70.1","5.15.0-1063.72.1","5.15.0-1064.73.1","5.15.0-1065.74.1","5.15.0-1067.76.1","5.15.0-1068.77.1","5.15.0-1070.79.1","5.15.0-1071.80.1","5.15.0-1072.81.1","5.15.0-1073.82.1","5.15.0-1076.85.1","5.15.0-1078.87.1","5.15.0-1081.90.1","5.15.0-1082.91.1","5.15.0-1084.93.1","5.15.0-1086.95.1","5.15.0-1087.96.1","5.15.0-1088.97.1","5.15.0-1089.98.1","5.15.0-1090.99.1","5.15.0-1091.100.1","5.15.0-1092.101.1","5.15.0-1094.103.1","5.15.0-1095.104.1","5.15.0-1096.105.1","5.15.0-1097.106.1","5.15.0-1098.107.1","5.15.0-1102.111.1","5.15.0-1109.118.1","5.15.0-1110.119.1","5.15.0-1111.120.1","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1120.129","5.15.0-1121.130"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1","6.8.0-1058.65~22.04.1","6.8.0-1061.68~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.70~22.04.1","6.8.0-1064.71~22.04.1","6.8.0-1065.72~22.04.1","6.8.0-1066.73~22.04.1","6.8.0-1068.75~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1077.86","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1080.89","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1101.110","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1106.115","5.15.0-1108.117","5.15.0-1109.118","5.15.0-1111.121","5.15.0-1112.122","5.15.0-1114.124","5.15.0-1115.125","5.15.0-1117.127"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1063.69~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1066.74~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1069.77~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.81~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1113.119"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1104.110","5.15.0-1105.111","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1100.108"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1048.55","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.58","5.15.0-1052.59","5.15.0-1053.60","5.15.0-1054.61","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.90","5.15.0-1083.91","5.15.0-1084.92","5.15.0-1086.94","5.15.0-1087.95","5.15.0-1088.96","5.15.0-1089.97","5.15.0-1091.99","5.15.0-1092.100","5.15.0-1094.102","5.15.0-1095.103","5.15.0-1096.104","5.15.0-1097.105","5.15.0-1098.106","5.15.0-1099.107"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.1","6.8.0-138.138~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1111.115"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1056.59","5.15.0-1057.60","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1068.71","5.15.0-1069.72","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1081.84","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1094.97","5.15.0-1095.98","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.109","5.15.0-1106.110","5.15.0-1107.111","5.15.0-1108.112","5.15.0-1109.113","5.15.0-1110.114"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1","6.8.0-1051.51~22.04.1","6.8.0-1052.52~22.04.1","6.8.0-1055.56~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1060.61~22.04.1","6.8.0-1061.62~22.04.1","6.8.0-1062.63~22.04.1","6.8.0-1063.64~22.04.1","6.8.0-1066.67~22.04.1","6.8.0-1069.70~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.118"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61","5.15.0-1057.63","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1098.104","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1103.109","5.15.0-1104.110","5.15.0-1106.112","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1109.114"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.65","5.15.0-1061.66","5.15.0-1062.67","5.15.0-1063.68","5.15.0-1064.69","5.15.0-1065.70","5.15.0-1066.71","5.15.0-1067.72","5.15.0-1068.73","5.15.0-1069.74","5.15.0-1070.75","5.15.0-1071.76","5.15.0-1072.77","5.15.0-1073.78","5.15.0-1076.81","5.15.0-1077.82","5.15.0-1078.83","5.15.0-1079.84","5.15.0-1080.85","5.15.0-1081.86","5.15.0-1082.87","5.15.0-1083.88","5.15.0-1084.89","5.15.0-1085.90","5.15.0-1086.91","5.15.0-1087.92","5.15.0-1088.93","5.15.0-1089.94","5.15.0-1090.95","5.15.0-1091.96","5.15.0-1092.97","5.15.0-1093.98","5.15.0-1095.100","5.15.0-1096.101","5.15.0-1097.102","5.15.0-1098.103","5.15.0-1100.105","5.15.0-1101.106","5.15.0-1103.108","5.15.0-1104.109","5.15.0-1105.110","5.15.0-1106.111","5.15.0-1107.112","5.15.0-1108.113"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-195.205"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-110.120","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-129.139","5.15.0-131.141","5.15.0-133.143","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-145.158","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-175.185","5.15.0-177.187","5.15.0-178.188","5.15.0-179.189","5.15.0-181.191","5.15.0-183.193","5.15.0-184.194","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1","6.8.0-110.110.1~22.04.1","6.8.0-111.111.1~22.04.1","6.8.0-117.117.1~22.04.1","6.8.0-134.134.1~22.04.1","6.8.0-136.136.2~22.04.1","6.8.0-137.137.1~22.04.1","6.8.0-138.138.1~22.04.1","6.8.0-139.139.1~22.04.1","6.8.0-142.142.1~22.04.1","6.8.0-146.146.1~22.04.1","6.8.0-149.149.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.113"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54","5.15.0-1054.55","5.15.0-1055.56","5.15.0-1058.59","5.15.0-1059.60","5.15.0-1060.61","5.15.0-1061.62","5.15.0-1062.63","5.15.0-1063.64","5.15.0-1064.65","5.15.0-1065.66","5.15.0-1066.67","5.15.0-1067.68","5.15.0-1068.69","5.15.0-1069.70","5.15.0-1070.71","5.15.0-1071.72","5.15.0-1072.73","5.15.0-1073.74","5.15.0-1074.75","5.15.0-1075.76","5.15.0-1076.77","5.15.0-1077.78","5.15.0-1078.79","5.15.0-1079.80","5.15.0-1080.81","5.15.0-1081.82","5.15.0-1082.83","5.15.0-1083.84","5.15.0-1085.86","5.15.0-1086.87","5.15.0-1087.88","5.15.0-1088.89","5.15.0-1090.91","5.15.0-1091.92","5.15.0-1092.93","5.15.0-1093.94","5.15.0-1094.95","5.15.0-1095.96","5.15.0-1096.97","5.15.0-1098.99","5.15.0-1099.100","5.15.0-1100.101","5.15.0-1101.102","5.15.0-1103.104","5.15.0-1104.105","5.15.0-1106.107","5.15.0-1107.108","5.15.0-1108.109","5.15.0-1109.110","5.15.0-1110.111","5.15.0-1111.112"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1070.72"}]}],"versions":["5.15.0-1009.9","5.15.0-1010.10","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1030.30","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1051.51","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1058.58","5.15.0-1060.60","5.15.0-1061.61","5.15.0-1063.63","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1068.70"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.59"}]}],"versions":["5.15.0-1001.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1009.9","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1023.23","5.15.0-1024.24","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1054.54","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1114.120"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1098.104","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1103.109","5.15.0-1105.111","5.15.0-1106.112","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1","6.8.0-1049.50~22.04.1","6.8.0-1050.51~22.04.1","6.8.0-1052.53~22.04.1","6.8.0-1054.55~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1067.71~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9","5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1008.8","5.15.0-1011.13","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.20","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1025.27","5.15.0-1026.28","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1029.31","5.15.0-1030.32","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1083.86","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.108","5.15.0-1106.109","5.15.0-1108.111","5.15.0-1110.113"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.3","6.8.0-137.137~22.04.1","6.8.0-138.138~22.04.1","6.8.0-139.139~22.04.1","6.8.0-142.142~22.04.1","6.8.0-146.146~22.04.1","6.8.0-149.149~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1080.84"}]}],"versions":["5.15.0-1022.26","5.15.0-1023.27","5.15.0-1025.29","5.15.0-1027.31","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.42","5.15.0-1039.43","5.15.0-1041.45","5.15.0-1044.48","5.15.0-1046.50","5.15.0-1050.54","5.15.0-1051.55","5.15.0-1052.56","5.15.0-1053.57","5.15.0-1054.58","5.15.0-1055.59","5.15.0-1056.60","5.15.0-1057.61","5.15.0-1059.63","5.15.0-1060.64","5.15.0-1061.65","5.15.0-1062.66","5.15.0-1063.67","5.15.0-1064.68","5.15.0-1065.69","5.15.0-1067.71","5.15.0-1068.72","5.15.0-1069.73","5.15.0-1070.74","5.15.0-1074.78","5.15.0-1075.79","5.15.0-1076.80","5.15.0-1077.81","5.15.0-1078.82","5.15.0-1079.83"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1101.103"}]}],"versions":["5.15.0-1011.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1017.19","5.15.0-1019.21","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1031.33","5.15.0-1032.34","5.15.0-1033.35","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1040.42","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1045.47","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1050.52","5.15.0-1051.53","5.15.0-1052.54","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1062.64","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1069.71","5.15.0-1070.72","5.15.0-1072.74","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1095.97","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1109.111"}]}],"versions":["5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1028.33","5.15.0-1033.35","5.15.0-1034.36","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1039.41","5.15.0-1040.42","5.15.0-1041.43","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1046.48","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1049.51","5.15.0-1050.52","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1055.57","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1066.68","5.15.0-1071.73","5.15.0-1072.74","5.15.0-1073.75","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1078.80","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1088.90","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1091.93","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1094.96","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106","5.15.0-1105.107","5.15.0-1106.108","5.15.0-1107.109","5.15.0-1108.110"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1116.125"}]}],"versions":["5.15.0-1006.6","5.15.0-1007.7","5.15.0-1009.9","5.15.0-1011.11","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1024.25","5.15.0-1025.28","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1039.42","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.52","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1077.85","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1107.116","5.15.0-1108.117","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1112.121","5.15.0-1113.122","5.15.0-1114.123","5.15.0-1115.124"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2","6.8.1-1047.48~22.04.1","6.8.1-1048.49~22.04.1","6.8.1-1051.52~22.04.1","6.8.1-1052.53~22.04.1","6.8.1-1055.56~22.04.1","6.8.1-1056.57~22.04.2","6.8.1-1057.58~22.04.1","6.8.1-1058.59~22.04.1","6.8.1-1059.60~22.04.1","6.8.1-1060.61~22.04.1","6.8.1-1061.62~22.04.1","6.8.1-1064.65~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1042.47+fips1","5.15.0-1051.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124+fips1"}]}],"versions":["5.15.0-1051.56+fips1","5.15.0-1052.57+fips1","5.15.0-1053.58+fips1","5.15.0-1055.60+fips1","5.15.0-1056.61+fips1","5.15.0-1057.63+fips1","5.15.0-1060.66+fips1","5.15.0-1061.67+fips1","5.15.0-1062.68+fips1","5.15.0-1063.69+fips1","5.15.0-1064.70+fips1","5.15.0-1065.71+fips1","5.15.0-1066.72+fips1","5.15.0-1067.73+fips1","5.15.0-1068.74+fips1","5.15.0-1069.75+fips1","5.15.0-1070.76+fips1","5.15.0-1071.77+fips1","5.15.0-1072.78+fips1","5.15.0-1073.79+fips1","5.15.0-1076.83+fips1","5.15.0-1077.84+fips1","5.15.0-1078.85+fips1","5.15.0-1079.86+fips1","5.15.0-1080.87+fips1","5.15.0-1081.88+fips1","5.15.0-1082.89+fips1","5.15.0-1083.90+fips1","5.15.0-1084.91+fips1","5.15.0-1085.92+fips1","5.15.0-1086.93+fips1","5.15.0-1087.94+fips1","5.15.0-1088.95+fips1","5.15.0-1089.96+fips1","5.15.0-1090.97+fips1","5.15.0-1091.98+fips1","5.15.0-1092.99+fips1","5.15.0-1093.100+fips1","5.15.0-1095.102+fips1","5.15.0-1096.103+fips1","5.15.0-1097.104+fips1","5.15.0-1098.105+fips1","5.15.0-1099.106+fips1","5.15.0-1100.107+fips1","5.15.0-1101.108+fips1","5.15.0-1103.110+fips1","5.15.0-1104.111+fips1","5.15.0-1105.112+fips1","5.15.0-1106.113+fips1","5.15.0-1108.115+fips1","5.15.0-1109.116+fips1","5.15.0-1111.118+fips1","5.15.0-1112.119+fips1","5.15.0-1113.120+fips1","5.15.0-1114.121+fips1","5.15.0-1115.122+fips1","5.15.0-1116.123+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132+fips1"}]}],"versions":["5.15.0-1053.61+fips1","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.69+fips1","5.15.0-1061.70+fips1","5.15.0-1063.72+fips1","5.15.0-1064.73+fips1","5.15.0-1065.74+fips1","5.15.0-1067.76+fips1","5.15.0-1068.77+fips1","5.15.0-1070.79+fips1","5.15.0-1071.80+fips1","5.15.0-1072.81+fips1","5.15.0-1073.82+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1085.94+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1089.98+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1094.103+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1101.110+fips1","5.15.0-1102.111+fips1","5.15.0-1103.112+fips1","5.15.0-1109.118+fips1","5.15.0-1110.119+fips1","5.15.0-1111.120+fips1","5.15.0-1114.123+fips1","5.15.0-1116.125+fips1","5.15.0-1117.126+fips1","5.15.0-1118.127+fips1","5.15.0-1119.128+fips1","5.15.0-1121.130+fips1","5.15.0-1122.131+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208+fips1"}]}],"versions":["5.15.0-73.80+fips1","5.15.0-92.102+fips1","5.15.0-94.104+fips1","5.15.0-97.107+fips1","5.15.0-100.110+fips1","5.15.0-101.111+fips1","5.15.0-102.112+fips1","5.15.0-105.115+fips1","5.15.0-106.116+fips1","5.15.0-107.117+fips1","5.15.0-111.121+fips1","5.15.0-113.123+fips1","5.15.0-115.125+fips1","5.15.0-117.127+fips1","5.15.0-118.128+fips1","5.15.0-119.129+fips1","5.15.0-121.131+fips1","5.15.0-122.132+fips1","5.15.0-124.134+fips1","5.15.0-125.135+fips1","5.15.0-127.137+fips1","5.15.0-128.138+fips1","5.15.0-130.140+fips1","5.15.0-131.141+fips1","5.15.0-133.144+fips1","5.15.0-134.145+fips1","5.15.0-135.146+fips1","5.15.0-136.147+fips1","5.15.0-138.148+fips1","5.15.0-139.149+fips1","5.15.0-140.150+fips1","5.15.0-141.151+fips1","5.15.0-142.152+fips1","5.15.0-143.153+fips1","5.15.0-144.157+fips1","5.15.0-145.158+fips1","5.15.0-152.162+fips1","5.15.0-153.163+fips1","5.15.0-156.166+fips1","5.15.0-157.167+fips1","5.15.0-160.170+fips1","5.15.0-161.171+fips1","5.15.0-163.173+fips1","5.15.0-164.174+fips1","5.15.0-168.178+fips1","5.15.0-170.180+fips1","5.15.0-171.181+fips1","5.15.0-173.183+fips1","5.15.0-174.184+fips1","5.15.0-176.186+fips1","5.15.0-177.187+fips1","5.15.0-179.189+fips1","5.15.0-181.191+fips1","5.15.0-185.195+fips1","5.15.0-186.196+fips1","5.15.0-190.200+fips1","5.15.0-191.201+fips1","5.15.0-194.204+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128+fips1"}]}],"versions":["5.15.0-1048.56+fips1","5.15.0-1055.63+fips2","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.68+fips1","5.15.0-1062.70+fips1","5.15.0-1063.71+fips1","5.15.0-1064.72+fips1","5.15.0-1065.73+fips1","5.15.0-1066.74+fips1","5.15.0-1067.75+fips1","5.15.0-1068.76+fips1","5.15.0-1069.77+fips1","5.15.0-1070.78+fips1","5.15.0-1071.79+fips1","5.15.0-1072.80+fips1","5.15.0-1073.81+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1077.86+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1081.90+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1084.93+fips1","5.15.0-1085.94+fips1","5.15.0-1086.95+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1092.101+fips1","5.15.0-1093.102+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1099.108+fips1","5.15.0-1100.109+fips1","5.15.0-1101.110+fips1","5.15.0-1103.112+fips1","5.15.0-1104.113+fips1","5.15.0-1105.114+fips1","5.15.0-1106.115+fips1","5.15.0-1108.117+fips1","5.15.0-1109.118+fips1","5.15.0-1111.121+fips1","5.15.0-1112.122+fips1","5.15.0-1114.124+fips1","5.15.0-1115.125+fips1","5.15.0-1116.126+fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107","6.8.0-110.110","6.8.0-111.111","6.8.0-117.117","6.8.0-124.124","6.8.0-134.134","6.8.0-136.136","6.8.0-137.137","6.8.0-138.138","6.8.0-139.139","6.8.0-142.142","6.8.0-146.146","6.8.0-147.147","6.8.0-149.149"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1055.58","6.8.0-1057.60","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1065.68","6.8.0-1066.69","6.8.0-1067.70","6.8.0-1069.74"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1007.7~24.04.2","7.0.0-1009.9~24.04.1","7.0.0-1010.10~24.04.1","7.0.0-1011.11~24.04.1","7.0.0-1012.12~24.04.1","7.0.0-1013.13~24.04.1","7.0.0-1014.14~24.04.1","7.0.0-1017.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58","6.8.0-1054.60","6.8.0-1056.62","6.8.0-1058.64","6.8.0-1059.65","6.8.0-1062.69","6.8.0-1063.71","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1067.75","6.8.0-1068.76","6.8.0-1070.78","6.8.0-1071.79"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1008.8~24.04.2","7.0.0-1014.14~24.04.1","7.0.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60","6.8.0-1058.65","6.8.0-1061.68","6.8.0-1062.69","6.8.0-1063.70","6.8.0-1064.71","6.8.0-1065.72","6.8.0-1066.73","6.8.0-1068.75","6.8.0-1069.76"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1007.7~24.04.3","7.0.0-1013.13~24.04.1","7.0.0-1016.16~24.04.1","7.0.0-1019.19~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1060.63","6.8.0-1063.69","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1067.75","6.8.0-1069.77","6.8.0-1070.78","6.8.0-1071.79","6.8.0-1073.81"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1","6.17.0-1009.9~24.04.3","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1016.17~24.04.1","6.17.0-1018.19~24.04.1","6.17.0-1020.22~24.04.1","6.17.0-1021.24~24.04.1","6.17.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6~24.04.2","7.0.0-1011.11~24.04.1","7.0.0-1013.13~24.04.1","7.0.0-1014.14~24.04.1","7.0.0-1017.19~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54","6.8.0-1050.56","6.8.0-1051.57","6.8.0-1054.60","6.8.0-1055.61","6.8.0-1058.64","6.8.0-1059.67","6.8.0-1060.68","6.8.0-1061.69","6.8.0-1062.70","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1068.77"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1037.40","6.8.0-1038.41","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1045.48","6.8.0-1046.50","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1049.53","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14~24.04.1","6.17.0-19.19~24.04.2","6.17.0-20.20~24.04.1","6.17.0-22.22~24.04.1","6.17.0-23.23~24.04.1","6.17.0-29.29~24.04.1","6.17.0-35.35~24.04.1","6.17.0-40.40~24.04.1","6.17.0-41.41~24.04.1","6.17.0-42.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42~24.04.1"}]}],"versions":["7.0.0-14.14~24.04.3","7.0.0-28.28~24.04.1","7.0.0-29.29~24.04.2","7.0.0-30.30~24.04.1","7.0.0-31.31~24.04.1","7.0.0-34.34~24.04.1","7.0.0-38.38~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50","6.8.0-1051.51","6.8.0-1052.52","6.8.0-1055.56","6.8.0-1057.58","6.8.0-1060.61","6.8.0-1061.62","6.8.0-1062.63","6.8.0-1063.64","6.8.0-1064.65","6.8.0-1065.66","6.8.0-1066.67","6.8.0-1067.68","6.8.0-1069.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1","6.8.0-110.110.1","6.8.0-111.111.1","6.8.0-117.117.1","6.8.0-134.134.1","6.8.0-136.136.2","6.8.0-137.137.1","6.8.0-138.138.1","6.8.0-139.139.1","6.8.0-142.142.1","6.8.0-146.146.1","6.8.0-147.147.1","6.8.0-149.149.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14","6.17.0-1018.18","6.17.0-1021.21","6.17.0-1026.26","6.17.0-1029.29","6.17.0-1031.31","6.17.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1013.13~24.04.1","7.0.0-1015.15~24.04.1","7.0.0-1016.16~24.04.1","7.0.0-1018.18~24.04.1","7.0.0-1019.19~24.04.2","7.0.0-1024.25~24.04.1","7.0.0-1025.26~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1","6.8.0-1051.54.1","6.8.0-1052.55.1","6.8.0-1054.57.1","6.8.0-1055.58.1","6.8.0-1058.61.1","6.8.0-1059.62.1","6.8.0-1060.63.1","6.8.0-1061.64.1","6.8.0-1062.65.1","6.8.0-1063.66.1","6.8.0-1064.67.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1036.39"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1031.32","6.8.0-1032.34","6.8.0-1035.38"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1017.17","6.17.0-1020.20","6.17.0-1023.23","6.17.0-1024.24","6.17.0-1025.25","6.17.0-1028.28","6.17.0-1030.30","6.17.0-1032.32","6.17.0-1033.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48","6.8.0-1049.50","6.8.0-1050.51","6.8.0-1052.53","6.8.0-1054.55","6.8.0-1057.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.71"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.1","6.17.0-1014.14~24.04.1","6.17.0-1016.16~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1019.19~24.04.3","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6~24.04.3","7.0.0-1011.11~24.04.1","7.0.0-1012.12~24.04.1","7.0.0-1013.13~24.04.1","7.0.0-1016.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57","6.8.0-1056.60","6.8.0-1057.61","6.8.0-1060.64","6.8.0-1061.65","6.8.0-1062.66","6.8.0-1063.67","6.8.0-1064.68","6.8.0-1065.69","6.8.0-1068.72"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42.1~24.04.1"}]}],"versions":["7.0.0-27.27.1~24.04.2","7.0.0-28.28.1~24.04.3","7.0.0-30.30.1~24.04.1","7.0.0-31.31.1~24.04.1","7.0.0-34.34.1~24.04.1","7.0.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1005.5","6.8.0-1008.8","6.8.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1034.35","6.8.0-1035.36","6.8.0-1036.37"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1026.30","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1032.37","6.8.0-1033.38","6.8.0-1036.41"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42","6.8.0-2042.43","6.8.0-2043.44","6.8.0-2045.46","6.8.0-2046.47","6.8.0-2049.50","6.8.0-2050.52","6.8.0-2051.53","6.8.0-2052.54","6.8.0-2053.55","6.8.0-2054.56","6.8.0-2056.58"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47","6.8.1-1047.48","6.8.1-1048.49","6.8.1-1051.52","6.8.1-1052.53","6.8.1-1055.56","6.8.1-1056.57","6.8.1-1057.58","6.8.1-1058.59","6.8.1-1059.60","6.8.1-1060.61","6.8.1-1061.62","6.8.1-1062.63","6.8.1-1064.65"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1055.58+fips1","6.8.0-1057.60+fips1","6.8.0-1060.63+fips1","6.8.0-1061.64+fips1","6.8.0-1062.65+fips1","6.8.0-1063.66+fips1","6.8.0-1064.67+fips1","6.8.0-1065.68+fips1","6.8.0-1066.69+fips1","6.8.0-1067.70+fips1","6.8.0-1069.74+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1","6.8.0-1053.59+fips1","6.8.0-1054.60+fips1","6.8.0-1059.65+fips1","6.8.0-1062.69+fips1","6.8.0-1063.71+fips2","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1069.77+fips1","6.8.0-1071.79+fips1","6.8.0-1073.82+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1","6.8.0-110.110+fips2","6.8.0-111.111+fips1","6.8.0-116.116+fips1","6.8.0-124.124+fips1","6.8.0-134.134+fips1","6.8.0-136.136+fips2","6.8.0-137.137+fips1","6.8.0-138.138+fips1","6.8.0-139.139+fips1","6.8.0-142.142+fips1","6.8.0-146.146+fips1","6.8.0-147.147+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1054.57+fips1","6.8.0-1055.58+fips1","6.8.0-1058.61+fips1","6.8.0-1060.63+fips1","6.8.0-1063.69+fips1","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1066.74+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1070.78+fips1","6.8.0-1071.79+fips1","6.8.0-1073.81+fips1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42"}]}],"versions":["6.17.0-5.5","6.17.0-6.6","6.17.0-8.8","6.18.0-8.8","6.18.0-9.9","6.19.0-3.3","6.19.0-5.5","6.19.0-6.6","6.19.0-9.9","7.0.0-7.7","7.0.0-10.10","7.0.0-12.12","7.0.0-13.13","7.0.0-14.14","7.0.0-15.15","7.0.0-22.22","7.0.0-27.27","7.0.0-28.28","7.0.0-29.29","7.0.0-30.30","7.0.0-31.31","7.0.0-34.34","7.0.0-38.38"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1016.17"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1002.2","6.19.0-1003.3","7.0.0-1001.1","7.0.0-1003.3","7.0.0-1004.4","7.0.0-1006.6","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13","7.0.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.19.0-1001.1","6.19.0-1002.2","7.0.0-1001.1","7.0.0-1002.2","7.0.0-1003.3","7.0.0-1004.4","7.0.0-1007.7","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1014.14","7.0.0-1017.17","7.0.0-1019.20","7.0.0-1020.21"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1003.3","7.0.0-1004.4","7.0.0-1006.6","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1013.13","7.0.0-1016.16","7.0.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1016.18"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1001.1","7.0.0-1001.1","7.0.0-1002.2","7.0.0-1003.3","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1008.8","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1013.13","7.0.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1002.3","7.0.0-1003.4","7.0.0-1005.6","7.0.0-1006.7","7.0.0-1007.8","7.0.0-1008.9","7.0.0-1010.11"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1017.17"}]}],"versions":["6.19.0-1002.2","6.19.0-1003.3","7.0.0-1002.2","7.0.0-1004.4","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13","7.0.0-1014.14","7.0.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1005.5","7.0.0-1006.6","7.0.0-1009.9","7.0.0-1013.13","7.0.0-1015.15","7.0.0-1016.16","7.0.0-1018.18","7.0.0-1025.26"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia-bos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-2012.12","7.0.0-2015.15","7.0.0-2016.16","7.0.0-2018.18","7.0.0-2022.23","7.0.0-2024.25"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-oem-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1017.17"}]}],"versions":["7.0.0-1005.5","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1013.13","7.0.0-1014.14","7.0.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1015.16"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1001.1","6.19.0-1002.2","7.0.0-1001.1","7.0.0-1002.2","7.0.0-1003.3","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","7.0.0-1004.4","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1014.14","7.0.0-1015.15","7.0.0-1016.16","7.0.0-1017.17","7.0.0-1019.19","7.0.0-1020.20","7.0.0-1023.23"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1001.2","7.0.0-10.10.3","7.0.0-12.12.1","7.0.0-14.14.1","7.0.0-22.22.1","7.0.0-27.27.1","7.0.0-28.28.1","7.0.0-29.29.1","7.0.0-30.30.1","7.0.0-31.31.1","7.0.0-34.34.1","7.0.0-38.38.1","7.0.0-43.43.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42.1"}]}],"versions":["6.17.0-5.5.1","7.0.0-7.7.1","7.0.0-12.12.1","7.0.0-14.14.2","7.0.0-22.22.1","7.0.0-27.27.1","7.0.0-28.28.1","7.0.0-29.29.1","7.0.0-30.30.1","7.0.0-31.31.1","7.0.0-34.34.1","7.0.0-38.38.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124~20.04.1"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1075.82~20.04.1","5.15.0-1077.84~20.04.1","5.15.0-1080.87~20.04.1","5.15.0-1081.88~20.04.1","5.15.0-1082.89~20.04.1","5.15.0-1083.90~20.04.1","5.15.0-1084.91~20.04.1","5.15.0-1086.93~20.04.1","5.15.0-1087.94~20.04.1","5.15.0-1088.95~20.04.1","5.15.0-1089.96~20.04.1","5.15.0-1090.97~20.04.1","5.15.0-1091.98~20.04.1","5.15.0-1092.99~20.04.1","5.15.0-1093.100~20.04.1","5.15.0-1095.102~20.04.1","5.15.0-1096.103~20.04.1","5.15.0-1097.104~20.04.1","5.15.0-1098.105~20.04.1","5.15.0-1099.106~20.04.1","5.15.0-1100.107~20.04.2","5.15.0-1101.108~20.04.1","5.15.0-1103.110~20.04.1","5.15.0-1104.111~20.04.1","5.15.0-1105.112~20.04.1","5.15.0-1106.113~20.04.1","5.15.0-1108.115~20.04.1","5.15.0-1109.116~20.04.1","5.15.0-1111.118~20.04.1","5.15.0-1112.119~20.04.1","5.15.0-1114.121~20.04.1","5.15.0-1115.122~20.04.1","5.15.0-1116.123~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132~20.04.1"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1","5.15.0-1063.72~20.04.1","5.15.0-1064.73~20.04.1","5.15.0-1065.74~20.04.1","5.15.0-1067.76~20.04.1","5.15.0-1068.77~20.04.1","5.15.0-1070.79~20.04.1","5.15.0-1071.80~20.04.1","5.15.0-1072.81~20.04.1","5.15.0-1073.82~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1079.88~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1082.91~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.1","5.15.0-1088.97~20.04.1","5.15.0-1089.98~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1094.103~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1102.111~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1110.119~20.04.1","5.15.0-1111.120~20.04.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1122.131~20.04.1"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-130.140~20.04.1","5.15.0-131.141~20.04.1","5.15.0-134.145~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-151.161~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.3","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-176.186~20.04.1","5.15.0-177.187~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-185.195~20.04.1","5.15.0-186.196~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1111.115~20.04.1"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1","5.15.0-1054.57~20.04.1","5.15.0-1055.58~20.04.1","5.15.0-1057.60~20.04.1","5.15.0-1058.61~20.04.1","5.15.0-1059.62~20.04.1","5.15.0-1060.63~20.04.1","5.15.0-1061.64~20.04.1","5.15.0-1062.65~20.04.1","5.15.0-1063.66~20.04.1","5.15.0-1064.67~20.04.1","5.15.0-1065.68~20.04.1","5.15.0-1066.69~20.04.1","5.15.0-1067.70~20.04.1","5.15.0-1068.71~20.04.1","5.15.0-1069.72~20.04.1","5.15.0-1074.77~20.04.1","5.15.0-1075.78~20.04.1","5.15.0-1076.79~20.04.1","5.15.0-1078.81~20.04.1","5.15.0-1079.82~20.04.1","5.15.0-1080.83~20.04.1","5.15.0-1081.84~20.04.1","5.15.0-1083.86~20.04.1","5.15.0-1085.88~20.04.1","5.15.0-1086.89~20.04.1","5.15.0-1087.90~20.04.1","5.15.0-1089.92~20.04.1","5.15.0-1090.93~20.04.1","5.15.0-1091.94~20.04.1","5.15.0-1092.95~20.04.1","5.15.0-1093.96~20.04.1","5.15.0-1094.97~20.04.1","5.15.0-1095.98~20.04.1","5.15.0-1097.100~20.04.1","5.15.0-1098.101~20.04.1","5.15.0-1099.102~20.04.1","5.15.0-1100.103~20.04.1","5.15.0-1102.105~20.04.1","5.15.0-1103.106~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.118~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1060.66~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.2","5.15.0-1074.80~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.1","5.15.0-1086.92~20.04.1","5.15.0-1087.93~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1099.105~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1103.109~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1107.113~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-195.205~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-110.120~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-128.138~20.04.1","5.15.0-129.139~20.04.1","5.15.0-131.141~20.04.1","5.15.0-133.143~20.04.1","5.15.0-134.145~20.04.1","5.15.0-135.146~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-140.150~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.1","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-174.184~20.04.1","5.15.0-175.185~20.04.1","5.15.0-177.187~20.04.1","5.15.0-178.188~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-183.193~20.04.1","5.15.0-184.194~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-112.122","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-130.140","5.15.0-131.141","5.15.0-133.144","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-151.161","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-176.186","5.15.0-177.187","5.15.0-179.189","5.15.0-181.191","5.15.0-185.195","5.15.0-186.196","5.15.0-187.197","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1076.83","5.15.0-1078.85","5.15.0-1079.86","5.15.0-1080.87","5.15.0-1081.88","5.15.0-1082.89","5.15.0-1083.90","5.15.0-1084.91","5.15.0-1085.92","5.15.0-1086.93","5.15.0-1087.94","5.15.0-1088.95","5.15.0-1089.96","5.15.0-1090.97","5.15.0-1091.98","5.15.0-1092.99","5.15.0-1093.100","5.15.0-1095.102","5.15.0-1096.103","5.15.0-1097.104","5.15.0-1098.105","5.15.0-1099.106","5.15.0-1100.107","5.15.0-1101.108","5.15.0-1103.110","5.15.0-1104.111","5.15.0-1105.112","5.15.0-1106.113","5.15.0-1108.115","5.15.0-1109.116","5.15.0-1111.118","5.15.0-1112.119","5.15.0-1113.120","5.15.0-1114.121","5.15.0-1115.122","5.15.0-1116.123"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70","5.15.0-1063.72","5.15.0-1064.73","5.15.0-1066.75","5.15.0-1067.76","5.15.0-1068.77","5.15.0-1070.79","5.15.0-1071.80","5.15.0-1072.81","5.15.0-1073.82","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1084.93","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1101.110","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1109.118","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1121.130","5.15.0-1122.131"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1113.119"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1104.110","5.15.0-1105.111","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1100.108"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1048.55","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.58","5.15.0-1052.59","5.15.0-1053.60","5.15.0-1054.61","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.90","5.15.0-1083.91","5.15.0-1084.92","5.15.0-1086.94","5.15.0-1087.95","5.15.0-1088.96","5.15.0-1089.97","5.15.0-1091.99","5.15.0-1092.100","5.15.0-1094.102","5.15.0-1095.103","5.15.0-1096.104","5.15.0-1097.105","5.15.0-1098.106","5.15.0-1099.107"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1111.115"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1056.59","5.15.0-1057.60","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1068.71","5.15.0-1069.72","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1081.84","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1094.97","5.15.0-1095.98","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.109","5.15.0-1106.110","5.15.0-1107.111","5.15.0-1108.112","5.15.0-1109.113","5.15.0-1110.114"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.118"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61","5.15.0-1057.63","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1098.104","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1103.109","5.15.0-1104.110","5.15.0-1106.112","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1109.114"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.65","5.15.0-1061.66","5.15.0-1062.67","5.15.0-1063.68","5.15.0-1064.69","5.15.0-1065.70","5.15.0-1066.71","5.15.0-1067.72","5.15.0-1068.73","5.15.0-1069.74","5.15.0-1070.75","5.15.0-1071.76","5.15.0-1072.77","5.15.0-1073.78","5.15.0-1076.81","5.15.0-1077.82","5.15.0-1078.83","5.15.0-1079.84","5.15.0-1080.85","5.15.0-1081.86","5.15.0-1082.87","5.15.0-1083.88","5.15.0-1084.89","5.15.0-1085.90","5.15.0-1086.91","5.15.0-1087.92","5.15.0-1088.93","5.15.0-1089.94","5.15.0-1090.95","5.15.0-1091.96","5.15.0-1092.97","5.15.0-1093.98","5.15.0-1095.100","5.15.0-1096.101","5.15.0-1097.102","5.15.0-1098.103","5.15.0-1100.105","5.15.0-1101.106","5.15.0-1103.108","5.15.0-1104.109","5.15.0-1105.110","5.15.0-1106.111","5.15.0-1107.112","5.15.0-1108.113"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-195.205"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-110.120","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-129.139","5.15.0-131.141","5.15.0-133.143","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-145.158","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-175.185","5.15.0-177.187","5.15.0-178.188","5.15.0-179.189","5.15.0-181.191","5.15.0-183.193","5.15.0-184.194","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1114.120"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1098.104","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1103.109","5.15.0-1105.111","5.15.0-1106.112","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1080.84"}]}],"versions":["5.15.0-1022.26","5.15.0-1023.27","5.15.0-1025.29","5.15.0-1027.31","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.42","5.15.0-1039.43","5.15.0-1041.45","5.15.0-1044.48","5.15.0-1046.50","5.15.0-1050.54","5.15.0-1051.55","5.15.0-1052.56","5.15.0-1053.57","5.15.0-1054.58","5.15.0-1055.59","5.15.0-1056.60","5.15.0-1057.61","5.15.0-1059.63","5.15.0-1060.64","5.15.0-1061.65","5.15.0-1062.66","5.15.0-1063.67","5.15.0-1064.68","5.15.0-1065.69","5.15.0-1067.71","5.15.0-1068.72","5.15.0-1069.73","5.15.0-1070.74","5.15.0-1074.78","5.15.0-1075.79","5.15.0-1076.80","5.15.0-1077.81","5.15.0-1078.82","5.15.0-1079.83"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1109.111"}]}],"versions":["5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1028.33","5.15.0-1033.35","5.15.0-1034.36","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1039.41","5.15.0-1040.42","5.15.0-1041.43","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1046.48","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1049.51","5.15.0-1050.52","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1055.57","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1066.68","5.15.0-1071.73","5.15.0-1072.74","5.15.0-1073.75","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1078.80","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1088.90","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1091.93","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1094.96","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106","5.15.0-1105.107","5.15.0-1106.108","5.15.0-1107.109","5.15.0-1108.110"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1116.125"}]}],"versions":["5.15.0-1006.6","5.15.0-1007.7","5.15.0-1009.9","5.15.0-1011.11","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1024.25","5.15.0-1025.28","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1039.42","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.52","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1077.85","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1107.116","5.15.0-1108.117","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1112.121","5.15.0-1113.122","5.15.0-1114.123","5.15.0-1115.124"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1117.124+fips1"}]}],"versions":["5.15.0-1051.56+fips1","5.15.0-1052.57+fips1","5.15.0-1053.58+fips1","5.15.0-1055.60+fips1","5.15.0-1056.61+fips1","5.15.0-1057.63+fips1","5.15.0-1060.66+fips1","5.15.0-1061.67+fips1","5.15.0-1062.68+fips1","5.15.0-1063.69+fips1","5.15.0-1064.70+fips1","5.15.0-1065.71+fips1","5.15.0-1066.72+fips1","5.15.0-1067.73+fips1","5.15.0-1068.74+fips1","5.15.0-1069.75+fips1","5.15.0-1070.76+fips1","5.15.0-1071.77+fips1","5.15.0-1072.78+fips1","5.15.0-1073.79+fips1","5.15.0-1076.83+fips1","5.15.0-1077.84+fips1","5.15.0-1078.85+fips1","5.15.0-1079.86+fips1","5.15.0-1080.87+fips1","5.15.0-1081.88+fips1","5.15.0-1082.89+fips1","5.15.0-1083.90+fips1","5.15.0-1084.91+fips1","5.15.0-1085.92+fips1","5.15.0-1086.93+fips1","5.15.0-1087.94+fips1","5.15.0-1088.95+fips1","5.15.0-1089.96+fips1","5.15.0-1090.97+fips1","5.15.0-1091.98+fips1","5.15.0-1092.99+fips1","5.15.0-1093.100+fips1","5.15.0-1095.102+fips1","5.15.0-1096.103+fips1","5.15.0-1097.104+fips1","5.15.0-1098.105+fips1","5.15.0-1099.106+fips1","5.15.0-1100.107+fips1","5.15.0-1101.108+fips1","5.15.0-1103.110+fips1","5.15.0-1104.111+fips1","5.15.0-1105.112+fips1","5.15.0-1106.113+fips1","5.15.0-1108.115+fips1","5.15.0-1109.116+fips1","5.15.0-1111.118+fips1","5.15.0-1112.119+fips1","5.15.0-1113.120+fips1","5.15.0-1114.121+fips1","5.15.0-1115.122+fips1","5.15.0-1116.123+fips1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1123.132+fips1"}]}],"versions":["5.15.0-1053.61+fips1","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.69+fips1","5.15.0-1061.70+fips1","5.15.0-1063.72+fips1","5.15.0-1064.73+fips1","5.15.0-1065.74+fips1","5.15.0-1067.76+fips1","5.15.0-1068.77+fips1","5.15.0-1070.79+fips1","5.15.0-1071.80+fips1","5.15.0-1072.81+fips1","5.15.0-1073.82+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1085.94+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1089.98+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1094.103+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1101.110+fips1","5.15.0-1102.111+fips1","5.15.0-1103.112+fips1","5.15.0-1109.118+fips1","5.15.0-1110.119+fips1","5.15.0-1111.120+fips1","5.15.0-1114.123+fips1","5.15.0-1116.125+fips1","5.15.0-1117.126+fips1","5.15.0-1118.127+fips1","5.15.0-1119.128+fips1","5.15.0-1121.130+fips1","5.15.0-1122.131+fips1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-198.208+fips1"}]}],"versions":["5.15.0-73.80+fips1","5.15.0-92.102+fips1","5.15.0-94.104+fips1","5.15.0-97.107+fips1","5.15.0-100.110+fips1","5.15.0-101.111+fips1","5.15.0-102.112+fips1","5.15.0-105.115+fips1","5.15.0-106.116+fips1","5.15.0-107.117+fips1","5.15.0-111.121+fips1","5.15.0-113.123+fips1","5.15.0-115.125+fips1","5.15.0-117.127+fips1","5.15.0-118.128+fips1","5.15.0-119.129+fips1","5.15.0-121.131+fips1","5.15.0-122.132+fips1","5.15.0-124.134+fips1","5.15.0-125.135+fips1","5.15.0-127.137+fips1","5.15.0-128.138+fips1","5.15.0-130.140+fips1","5.15.0-131.141+fips1","5.15.0-133.144+fips1","5.15.0-134.145+fips1","5.15.0-135.146+fips1","5.15.0-136.147+fips1","5.15.0-138.148+fips1","5.15.0-139.149+fips1","5.15.0-140.150+fips1","5.15.0-141.151+fips1","5.15.0-142.152+fips1","5.15.0-143.153+fips1","5.15.0-144.157+fips1","5.15.0-145.158+fips1","5.15.0-152.162+fips1","5.15.0-153.163+fips1","5.15.0-156.166+fips1","5.15.0-157.167+fips1","5.15.0-160.170+fips1","5.15.0-161.171+fips1","5.15.0-163.173+fips1","5.15.0-164.174+fips1","5.15.0-168.178+fips1","5.15.0-170.180+fips1","5.15.0-171.181+fips1","5.15.0-173.183+fips1","5.15.0-174.184+fips1","5.15.0-176.186+fips1","5.15.0-177.187+fips1","5.15.0-179.189+fips1","5.15.0-181.191+fips1","5.15.0-185.195+fips1","5.15.0-186.196+fips1","5.15.0-190.200+fips1","5.15.0-191.201+fips1","5.15.0-194.204+fips1"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1112.113"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54","5.15.0-1054.55","5.15.0-1055.56","5.15.0-1058.59","5.15.0-1059.60","5.15.0-1060.61","5.15.0-1061.62","5.15.0-1062.63","5.15.0-1063.64","5.15.0-1064.65","5.15.0-1065.66","5.15.0-1066.67","5.15.0-1067.68","5.15.0-1068.69","5.15.0-1069.70","5.15.0-1070.71","5.15.0-1071.72","5.15.0-1072.73","5.15.0-1073.74","5.15.0-1074.75","5.15.0-1075.76","5.15.0-1076.77","5.15.0-1077.78","5.15.0-1078.79","5.15.0-1079.80","5.15.0-1080.81","5.15.0-1081.82","5.15.0-1082.83","5.15.0-1083.84","5.15.0-1085.86","5.15.0-1086.87","5.15.0-1087.88","5.15.0-1088.89","5.15.0-1090.91","5.15.0-1091.92","5.15.0-1092.93","5.15.0-1093.94","5.15.0-1094.95","5.15.0-1095.96","5.15.0-1096.97","5.15.0-1098.99","5.15.0-1099.100","5.15.0-1100.101","5.15.0-1101.102","5.15.0-1103.104","5.15.0-1104.105","5.15.0-1106.107","5.15.0-1107.108","5.15.0-1108.109","5.15.0-1109.110","5.15.0-1110.111","5.15.0-1111.112"],"bundled":951},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1077.86","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1080.89","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1101.110","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1106.115","5.15.0-1108.117","5.15.0-1109.118","5.15.0-1111.121","5.15.0-1112.122","5.15.0-1114.124","5.15.0-1115.125","5.15.0-1117.127"],"bundled":952},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128+fips1"}]}],"versions":["5.15.0-1048.56+fips1","5.15.0-1055.63+fips2","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.68+fips1","5.15.0-1062.70+fips1","5.15.0-1063.71+fips1","5.15.0-1064.72+fips1","5.15.0-1065.73+fips1","5.15.0-1066.74+fips1","5.15.0-1067.75+fips1","5.15.0-1068.76+fips1","5.15.0-1069.77+fips1","5.15.0-1070.78+fips1","5.15.0-1071.79+fips1","5.15.0-1072.80+fips1","5.15.0-1073.81+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1077.86+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1081.90+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1084.93+fips1","5.15.0-1085.94+fips1","5.15.0-1086.95+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1092.101+fips1","5.15.0-1093.102+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1099.108+fips1","5.15.0-1100.109+fips1","5.15.0-1101.110+fips1","5.15.0-1103.112+fips1","5.15.0-1104.113+fips1","5.15.0-1105.114+fips1","5.15.0-1106.115+fips1","5.15.0-1108.117+fips1","5.15.0-1109.118+fips1","5.15.0-1111.121+fips1","5.15.0-1112.122+fips1","5.15.0-1114.124+fips1","5.15.0-1115.125+fips1","5.15.0-1116.126+fips1"],"bundled":952},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1118.128~20.04.1"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1","5.15.0-1059.67~20.04.1","5.15.0-1060.68~20.04.1","5.15.0-1062.70~20.04.1","5.15.0-1065.73~20.04.1","5.15.0-1066.74~20.04.1","5.15.0-1067.75~20.04.1","5.15.0-1068.76~20.04.1","5.15.0-1069.77~20.04.1","5.15.0-1070.78~20.04.1","5.15.0-1071.79~20.04.1","5.15.0-1072.80~20.04.1","5.15.0-1073.81~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1077.86~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1083.92~20.04.1","5.15.0-1085.94~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.2","5.15.0-1088.97~20.04.1","5.15.0-1090.99~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1092.101~20.04.1","5.15.0-1093.102~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1099.108~20.04.1","5.15.0-1100.109~20.04.1","5.15.0-1101.110~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1104.113~20.04.1","5.15.0-1106.115~20.04.1","5.15.0-1108.117~20.04.1","5.15.0-1109.118~20.04.1","5.15.0-1111.121~20.04.1","5.15.0-1112.122~20.04.1","5.15.0-1114.124~20.04.1"],"bundled":973},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1114.120~20.04.1"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1074.80~20.04.1","5.15.0-1075.81~20.04.1","5.15.0-1076.82~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1080.86~20.04.1","5.15.0-1081.87~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.3","5.15.0-1086.92~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1097.103~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1102.108~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1"],"bundled":972},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1036.39"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1031.32","6.8.0-1032.34","6.8.0-1035.38"],"bundled":684},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42~24.04.1"}]}],"versions":["7.0.0-14.14~24.04.3","7.0.0-28.28~24.04.1","7.0.0-29.29~24.04.2","7.0.0-30.30~24.04.1","7.0.0-31.31~24.04.1","7.0.0-34.34~24.04.1","7.0.0-38.38~24.04.4"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-42.42"}]}],"versions":["6.17.0-5.5","6.17.0-6.6","6.17.0-8.8","6.18.0-8.8","6.18.0-9.9","6.19.0-3.3","6.19.0-5.5","6.19.0-6.6","6.19.0-9.9","7.0.0-7.7","7.0.0-10.10","7.0.0-12.12","7.0.0-13.13","7.0.0-14.14","7.0.0-15.15","7.0.0-22.22","7.0.0-27.27","7.0.0-28.28","7.0.0-29.29","7.0.0-30.30","7.0.0-31.31","7.0.0-34.34","7.0.0-38.38"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1016.17"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1002.2","6.19.0-1003.3","7.0.0-1001.1","7.0.0-1003.3","7.0.0-1004.4","7.0.0-1006.6","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13","7.0.0-1014.14"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1016.18"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1001.1","7.0.0-1001.1","7.0.0-1002.2","7.0.0-1003.3","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1008.8","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1013.13","7.0.0-1014.14"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1017.17"}]}],"versions":["6.19.0-1002.2","6.19.0-1003.3","7.0.0-1002.2","7.0.0-1004.4","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13","7.0.0-1014.14","7.0.0-1015.15"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1015.16"}]}],"versions":["6.17.0-1002.2","6.17.0-1003.3","6.19.0-1001.1","6.19.0-1002.2","7.0.0-1001.1","7.0.0-1002.2","7.0.0-1003.3","7.0.0-1005.5","7.0.0-1007.7","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1012.12","7.0.0-1013.13"],"bundled":2894},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-oem-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1017.17"}]}],"versions":["7.0.0-1005.5","7.0.0-1008.8","7.0.0-1009.9","7.0.0-1010.10","7.0.0-1011.11","7.0.0-1013.13","7.0.0-1014.14","7.0.0-1015.15"],"bundled":2889},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-nvidia-tegra-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1070.72~20.04.1"}]}],"versions":["5.15.0-1009.9~20.04.1","5.15.0-1010.10~20.04.1","5.15.0-1012.12~20.04.1","5.15.0-1014.14~20.04.1","5.15.0-1015.15~20.04.1","5.15.0-1016.16~20.04.1","5.15.0-1017.17~20.04.1","5.15.0-1018.18~20.04.1","5.15.0-1019.19~20.04.1","5.15.0-1020.20~20.04.1","5.15.0-1022.22~20.04.1","5.15.0-1025.25~20.04.1","5.15.0-1027.27~20.04.1","5.15.0-1030.30~20.04.1","5.15.0-1032.32~20.04.1","5.15.0-1039.39~20.04.1","5.15.0-1040.40~20.04.1","5.15.0-1041.41~20.04.1","5.15.0-1042.42~20.04.1","5.15.0-1043.43~20.04.1","5.15.0-1044.44~20.04.1","5.15.0-1045.45~20.04.1","5.15.0-1046.46~20.04.1","5.15.0-1047.47~20.04.1","5.15.0-1048.48~20.04.1","5.15.0-1049.49~20.04.1","5.15.0-1050.50~20.04.1","5.15.0-1051.51~20.04.1","5.15.0-1052.52~20.04.2","5.15.0-1053.53~20.04.1","5.15.0-1055.55~20.04.1","5.15.0-1057.57~20.04.1","5.15.0-1058.58~20.04.1","5.15.0-1060.60~20.04.1","5.15.0-1061.61~20.04.1","5.15.0-1063.63~20.04.1","5.15.0-1064.66~20.04.1","5.15.0-1065.67~20.04.1","5.15.0-1066.68~20.04.1","5.15.0-1067.69~20.04.1","5.15.0-1068.70~20.04.1"],"bundled":2016},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1070.72"}]}],"versions":["5.15.0-1009.9","5.15.0-1010.10","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1030.30","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1051.51","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1058.58","5.15.0-1060.60","5.15.0-1061.61","5.15.0-1063.63","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1068.70"],"bundled":2016},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.59"}]}],"versions":["5.15.0-1001.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1009.9","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1023.23","5.15.0-1024.24","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1054.54","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57"],"bundled":2016},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.25"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401}],"products":[{"vendor":"linux","product":"linux"}],"references":[{"url":"https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74609","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c6xm-fh9c-399h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-74609","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1789141176.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50646","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38117","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38593","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23395","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64579","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68202","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74641","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74700","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80558","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789898700.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64335","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64348","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64435","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72438","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80529","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89555","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1789958474.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53179","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39985","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52942","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64372","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64438","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68335","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89789","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791800936.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23278","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31593","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43028","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43030","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72069","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98173","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791876326.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72070","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89484","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89553","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89951","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89952","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89972","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90016","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97455","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791878869.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791946572.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50401","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23455","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64274","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68140","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68397","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93117","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97954","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792243729.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38361","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98354","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99999","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792247642.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64548","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74609.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-74609","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0506.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36452","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.45","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.46","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.47","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.48","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.49","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.50","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.51","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.52","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.53","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.54","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.55","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0542.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36453","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64523","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74485","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74509","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74666","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74748","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80560","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80721","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74591","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80554","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89485","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90316","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253340","tags":["report"]},{"url":"https://bugzilla.suse.com/1258335","tags":["report"]},{"url":"https://bugzilla.suse.com/1260474","tags":["report"]},{"url":"https://bugzilla.suse.com/1261564","tags":["report"]},{"url":"https://bugzilla.suse.com/1261816","tags":["report"]},{"url":"https://bugzilla.suse.com/1264330","tags":["report"]},{"url":"https://bugzilla.suse.com/1264607","tags":["report"]},{"url":"https://bugzilla.suse.com/1264747","tags":["report"]},{"url":"https://bugzilla.suse.com/1266410","tags":["report"]},{"url":"https://bugzilla.suse.com/1266848","tags":["report"]},{"url":"https://bugzilla.suse.com/1267464","tags":["report"]},{"url":"https://bugzilla.suse.com/1267672","tags":["report"]},{"url":"https://bugzilla.suse.com/1271817","tags":["report"]},{"url":"https://bugzilla.suse.com/1271901","tags":["report"]},{"url":"https://bugzilla.suse.com/1271950","tags":["report"]},{"url":"https://bugzilla.suse.com/1272145","tags":["report"]},{"url":"https://bugzilla.suse.com/1272215","tags":["report"]},{"url":"https://bugzilla.suse.com/1272347","tags":["report"]},{"url":"https://bugzilla.suse.com/1272388","tags":["report"]},{"url":"https://bugzilla.suse.com/1272473","tags":["report"]},{"url":"https://bugzilla.suse.com/1272571","tags":["report"]},{"url":"https://bugzilla.suse.com/1272802","tags":["report"]},{"url":"https://bugzilla.suse.com/1272803","tags":["report"]},{"url":"https://bugzilla.suse.com/1272890","tags":["report"]},{"url":"https://bugzilla.suse.com/1273040","tags":["report"]},{"url":"https://bugzilla.suse.com/1273059","tags":["report"]},{"url":"https://bugzilla.suse.com/1273116","tags":["report"]},{"url":"https://bugzilla.suse.com/1273258","tags":["report"]},{"url":"https://bugzilla.suse.com/1273275","tags":["report"]},{"url":"https://bugzilla.suse.com/1273290","tags":["report"]},{"url":"https://bugzilla.suse.com/1273297","tags":["report"]},{"url":"https://bugzilla.suse.com/1273320","tags":["report"]},{"url":"https://bugzilla.suse.com/1273491","tags":["report"]},{"url":"https://bugzilla.suse.com/1273512","tags":["report"]},{"url":"https://bugzilla.suse.com/1273784","tags":["report"]},{"url":"https://bugzilla.suse.com/1273879","tags":["report"]},{"url":"https://bugzilla.suse.com/1273889","tags":["report"]},{"url":"https://bugzilla.suse.com/1273938","tags":["report"]},{"url":"https://bugzilla.suse.com/1273970","tags":["report"]},{"url":"https://bugzilla.suse.com/1273976","tags":["report"]},{"url":"https://bugzilla.suse.com/1273982","tags":["report"]},{"url":"https://bugzilla.suse.com/1274037","tags":["report"]},{"url":"https://bugzilla.suse.com/1274061","tags":["report"]},{"url":"https://bugzilla.suse.com/1274245","tags":["report"]},{"url":"https://bugzilla.suse.com/1274297","tags":["report"]},{"url":"https://bugzilla.suse.com/1274298","tags":["report"]},{"url":"https://bugzilla.suse.com/1274316","tags":["report"]},{"url":"https://bugzilla.suse.com/1274319","tags":["report"]},{"url":"https://bugzilla.suse.com/1274538","tags":["report"]},{"url":"https://bugzilla.suse.com/1274629","tags":["report"]},{"url":"https://bugzilla.suse.com/1274663","tags":["report"]},{"url":"https://bugzilla.suse.com/1274776","tags":["report"]},{"url":"https://bugzilla.suse.com/1274818","tags":["report"]},{"url":"https://bugzilla.suse.com/1274824","tags":["report"]},{"url":"https://bugzilla.suse.com/1274836","tags":["report"]},{"url":"https://bugzilla.suse.com/1274890","tags":["report"]},{"url":"https://bugzilla.suse.com/1274912","tags":["report"]},{"url":"https://bugzilla.suse.com/1274920","tags":["report"]},{"url":"https://bugzilla.suse.com/1275137","tags":["report"]},{"url":"https://bugzilla.suse.com/1275142","tags":["report"]},{"url":"https://bugzilla.suse.com/1275170","tags":["report"]},{"url":"https://bugzilla.suse.com/1275495","tags":["report"]},{"url":"https://bugzilla.suse.com/1275543","tags":["report"]},{"url":"https://bugzilla.suse.com/1275545","tags":["report"]},{"url":"https://bugzilla.suse.com/1275549","tags":["report"]},{"url":"https://bugzilla.suse.com/1275559","tags":["report"]},{"url":"https://bugzilla.suse.com/1275567","tags":["report"]},{"url":"https://bugzilla.suse.com/1275682","tags":["report"]},{"url":"https://bugzilla.suse.com/1275740","tags":["report"]},{"url":"https://bugzilla.suse.com/1275924","tags":["report"]},{"url":"https://bugzilla.suse.com/1275953","tags":["report"]},{"url":"https://bugzilla.suse.com/1275972","tags":["report"]},{"url":"https://bugzilla.suse.com/1275977","tags":["report"]},{"url":"https://bugzilla.suse.com/1276007","tags":["report"]},{"url":"https://bugzilla.suse.com/1276009","tags":["report"]},{"url":"https://bugzilla.suse.com/1276262","tags":["report"]},{"url":"https://bugzilla.suse.com/1276287","tags":["report"]},{"url":"https://bugzilla.suse.com/1276295","tags":["report"]},{"url":"https://bugzilla.suse.com/1276337","tags":["report"]},{"url":"https://bugzilla.suse.com/1276338","tags":["report"]},{"url":"https://bugzilla.suse.com/1276340","tags":["report"]},{"url":"https://bugzilla.suse.com/1276345","tags":["report"]},{"url":"https://bugzilla.suse.com/1276347","tags":["report"]},{"url":"https://bugzilla.suse.com/1276349","tags":["report"]},{"url":"https://bugzilla.suse.com/1276352","tags":["report"]},{"url":"https://bugzilla.suse.com/1276353","tags":["report"]},{"url":"https://bugzilla.suse.com/1276388","tags":["report"]},{"url":"https://bugzilla.suse.com/1276460","tags":["report"]},{"url":"https://bugzilla.suse.com/1276461","tags":["report"]},{"url":"https://bugzilla.suse.com/1276462","tags":["report"]},{"url":"https://bugzilla.suse.com/1276474","tags":["report"]},{"url":"https://bugzilla.suse.com/1276475","tags":["report"]},{"url":"https://bugzilla.suse.com/1276504","tags":["report"]},{"url":"https://bugzilla.suse.com/1276508","tags":["report"]},{"url":"https://bugzilla.suse.com/1276519","tags":["report"]},{"url":"https://bugzilla.suse.com/1276532","tags":["report"]},{"url":"https://bugzilla.suse.com/1276535","tags":["report"]},{"url":"https://bugzilla.suse.com/1276538","tags":["report"]},{"url":"https://bugzilla.suse.com/1276563","tags":["report"]},{"url":"https://bugzilla.suse.com/1276565","tags":["report"]},{"url":"https://bugzilla.suse.com/1276570","tags":["report"]},{"url":"https://bugzilla.suse.com/1276573","tags":["report"]},{"url":"https://bugzilla.suse.com/1276579","tags":["report"]},{"url":"https://bugzilla.suse.com/1276783","tags":["report"]},{"url":"https://bugzilla.suse.com/1276852","tags":["report"]},{"url":"https://bugzilla.suse.com/1276921","tags":["report"]},{"url":"https://bugzilla.suse.com/1276923","tags":["report"]},{"url":"https://bugzilla.suse.com/1276927","tags":["report"]},{"url":"https://bugzilla.suse.com/1276930","tags":["report"]},{"url":"https://bugzilla.suse.com/1276947","tags":["report"]},{"url":"https://bugzilla.suse.com/1277030","tags":["report"]},{"url":"https://bugzilla.suse.com/1277032","tags":["report"]},{"url":"https://bugzilla.suse.com/1277036","tags":["report"]},{"url":"https://bugzilla.suse.com/1277098","tags":["report"]},{"url":"https://bugzilla.suse.com/1277101","tags":["report"]},{"url":"https://bugzilla.suse.com/1277109","tags":["report"]},{"url":"https://bugzilla.suse.com/1277122","tags":["report"]},{"url":"https://bugzilla.suse.com/1277128","tags":["report"]},{"url":"https://bugzilla.suse.com/1277129","tags":["report"]},{"url":"https://bugzilla.suse.com/1277143","tags":["report"]},{"url":"https://bugzilla.suse.com/1277149","tags":["report"]},{"url":"https://bugzilla.suse.com/1277153","tags":["report"]},{"url":"https://bugzilla.suse.com/1277215","tags":["report"]},{"url":"https://bugzilla.suse.com/1277217","tags":["report"]},{"url":"https://bugzilla.suse.com/1277218","tags":["report"]},{"url":"https://bugzilla.suse.com/1277234","tags":["report"]},{"url":"https://bugzilla.suse.com/1277245","tags":["report"]},{"url":"https://bugzilla.suse.com/1277272","tags":["report"]},{"url":"https://bugzilla.suse.com/1277277","tags":["report"]},{"url":"https://bugzilla.suse.com/1277296","tags":["report"]},{"url":"https://bugzilla.suse.com/1277314","tags":["report"]},{"url":"https://bugzilla.suse.com/1277342","tags":["report"]},{"url":"https://bugzilla.suse.com/1277371","tags":["report"]},{"url":"https://bugzilla.suse.com/1277372","tags":["report"]},{"url":"https://bugzilla.suse.com/1277374","tags":["report"]},{"url":"https://bugzilla.suse.com/1277379","tags":["report"]},{"url":"https://bugzilla.suse.com/1277382","tags":["report"]},{"url":"https://bugzilla.suse.com/1277392","tags":["report"]},{"url":"https://bugzilla.suse.com/1277396","tags":["report"]},{"url":"https://bugzilla.suse.com/1277401","tags":["report"]},{"url":"https://bugzilla.suse.com/1277405","tags":["report"]},{"url":"https://bugzilla.suse.com/1277410","tags":["report"]},{"url":"https://bugzilla.suse.com/1277452","tags":["report"]},{"url":"https://bugzilla.suse.com/1277489","tags":["report"]},{"url":"https://bugzilla.suse.com/1277493","tags":["report"]},{"url":"https://bugzilla.suse.com/1277555","tags":["report"]},{"url":"https://bugzilla.suse.com/1277556","tags":["report"]},{"url":"https://bugzilla.suse.com/1277557","tags":["report"]},{"url":"https://bugzilla.suse.com/1277558","tags":["report"]},{"url":"https://bugzilla.suse.com/1277568","tags":["report"]},{"url":"https://bugzilla.suse.com/1277615","tags":["report"]},{"url":"https://bugzilla.suse.com/1277625","tags":["report"]},{"url":"https://bugzilla.suse.com/1277626","tags":["report"]},{"url":"https://bugzilla.suse.com/1277640","tags":["report"]},{"url":"https://bugzilla.suse.com/1277662","tags":["report"]},{"url":"https://bugzilla.suse.com/1277674","tags":["report"]},{"url":"https://bugzilla.suse.com/1277705","tags":["report"]},{"url":"https://bugzilla.suse.com/1277766","tags":["report"]},{"url":"https://bugzilla.suse.com/1277781","tags":["report"]},{"url":"https://bugzilla.suse.com/1277784","tags":["report"]},{"url":"https://bugzilla.suse.com/1277792","tags":["report"]},{"url":"https://bugzilla.suse.com/1277801","tags":["report"]},{"url":"https://bugzilla.suse.com/1277805","tags":["report"]},{"url":"https://bugzilla.suse.com/1277820","tags":["report"]},{"url":"https://bugzilla.suse.com/1277823","tags":["report"]},{"url":"https://bugzilla.suse.com/1277824","tags":["report"]},{"url":"https://bugzilla.suse.com/1277840","tags":["report"]},{"url":"https://bugzilla.suse.com/1277843","tags":["report"]},{"url":"https://bugzilla.suse.com/1277844","tags":["report"]},{"url":"https://bugzilla.suse.com/1277857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277864","tags":["report"]},{"url":"https://bugzilla.suse.com/1277885","tags":["report"]},{"url":"https://bugzilla.suse.com/1277892","tags":["report"]},{"url":"https://bugzilla.suse.com/1277895","tags":["report"]},{"url":"https://bugzilla.suse.com/1277896","tags":["report"]},{"url":"https://bugzilla.suse.com/1277897","tags":["report"]},{"url":"https://bugzilla.suse.com/1277900","tags":["report"]},{"url":"https://bugzilla.suse.com/1277904","tags":["report"]},{"url":"https://bugzilla.suse.com/1277906","tags":["report"]},{"url":"https://bugzilla.suse.com/1277910","tags":["report"]},{"url":"https://bugzilla.suse.com/1277913","tags":["report"]},{"url":"https://bugzilla.suse.com/1277915","tags":["report"]},{"url":"https://bugzilla.suse.com/1278031","tags":["report"]},{"url":"https://bugzilla.suse.com/1278035","tags":["report"]},{"url":"https://bugzilla.suse.com/1278053","tags":["report"]},{"url":"https://bugzilla.suse.com/1278054","tags":["report"]},{"url":"https://bugzilla.suse.com/1278056","tags":["report"]},{"url":"https://bugzilla.suse.com/1278063","tags":["report"]},{"url":"https://bugzilla.suse.com/1278067","tags":["report"]},{"url":"https://bugzilla.suse.com/1278087","tags":["report"]},{"url":"https://bugzilla.suse.com/1278091","tags":["report"]},{"url":"https://bugzilla.suse.com/1278100","tags":["report"]},{"url":"https://bugzilla.suse.com/1278191","tags":["report"]},{"url":"https://bugzilla.suse.com/1278195","tags":["report"]},{"url":"https://bugzilla.suse.com/1278199","tags":["report"]},{"url":"https://bugzilla.suse.com/1278205","tags":["report"]},{"url":"https://bugzilla.suse.com/1278215","tags":["report"]},{"url":"https://bugzilla.suse.com/1278216","tags":["report"]},{"url":"https://bugzilla.suse.com/1278225","tags":["report"]},{"url":"https://bugzilla.suse.com/1278245","tags":["report"]},{"url":"https://bugzilla.suse.com/1278247","tags":["report"]},{"url":"https://bugzilla.suse.com/1278255","tags":["report"]},{"url":"https://bugzilla.suse.com/1278311","tags":["report"]},{"url":"https://bugzilla.suse.com/1278314","tags":["report"]},{"url":"https://bugzilla.suse.com/1278315","tags":["report"]},{"url":"https://bugzilla.suse.com/1278363","tags":["report"]},{"url":"https://bugzilla.suse.com/1278708","tags":["report"]},{"url":"https://bugzilla.suse.com/1279116","tags":["report"]},{"url":"https://bugzilla.suse.com/1279497","tags":["report"]},{"url":"https://bugzilla.suse.com/1279525","tags":["report"]},{"url":"https://bugzilla.suse.com/1279527","tags":["report"]},{"url":"https://bugzilla.suse.com/1279532","tags":["report"]},{"url":"https://bugzilla.suse.com/1279535","tags":["report"]},{"url":"https://bugzilla.suse.com/1279536","tags":["report"]},{"url":"https://bugzilla.suse.com/1279569","tags":["report"]},{"url":"https://bugzilla.suse.com/1279581","tags":["report"]},{"url":"https://bugzilla.suse.com/1279590","tags":["report"]},{"url":"https://bugzilla.suse.com/1279621","tags":["report"]},{"url":"https://bugzilla.suse.com/1279702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279786","tags":["report"]},{"url":"https://bugzilla.suse.com/1279799","tags":["report"]},{"url":"https://bugzilla.suse.com/1279819","tags":["report"]},{"url":"https://bugzilla.suse.com/1279835","tags":["report"]},{"url":"https://bugzilla.suse.com/1279850","tags":["report"]},{"url":"https://bugzilla.suse.com/1279875","tags":["report"]},{"url":"https://bugzilla.suse.com/1279878","tags":["report"]},{"url":"https://bugzilla.suse.com/1279888","tags":["report"]},{"url":"https://bugzilla.suse.com/1280143","tags":["report"]},{"url":"https://bugzilla.suse.com/1280146","tags":["report"]},{"url":"https://bugzilla.suse.com/1280148","tags":["report"]},{"url":"https://bugzilla.suse.com/1280151","tags":["report"]},{"url":"https://bugzilla.suse.com/1280163","tags":["report"]},{"url":"https://bugzilla.suse.com/1280166","tags":["report"]},{"url":"https://bugzilla.suse.com/1280171","tags":["report"]},{"url":"https://bugzilla.suse.com/1280178","tags":["report"]},{"url":"https://bugzilla.suse.com/1280179","tags":["report"]},{"url":"https://bugzilla.suse.com/1280184","tags":["report"]},{"url":"https://bugzilla.suse.com/1280193","tags":["report"]},{"url":"https://bugzilla.suse.com/1280206","tags":["report"]},{"url":"https://bugzilla.suse.com/1280235","tags":["report"]},{"url":"https://bugzilla.suse.com/1280237","tags":["report"]},{"url":"https://bugzilla.suse.com/1280243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280251","tags":["report"]},{"url":"https://bugzilla.suse.com/1280252","tags":["report"]},{"url":"https://bugzilla.suse.com/1280263","tags":["report"]},{"url":"https://bugzilla.suse.com/1280296","tags":["report"]},{"url":"https://bugzilla.suse.com/1280298","tags":["report"]},{"url":"https://bugzilla.suse.com/1280299","tags":["report"]},{"url":"https://bugzilla.suse.com/1280303","tags":["report"]},{"url":"https://bugzilla.suse.com/1280309","tags":["report"]},{"url":"https://bugzilla.suse.com/1280333","tags":["report"]},{"url":"https://bugzilla.suse.com/1280334","tags":["report"]},{"url":"https://bugzilla.suse.com/1280335","tags":["report"]},{"url":"https://bugzilla.suse.com/1280336","tags":["report"]},{"url":"https://bugzilla.suse.com/1280338","tags":["report"]},{"url":"https://bugzilla.suse.com/1280350","tags":["report"]},{"url":"https://bugzilla.suse.com/1280375","tags":["report"]},{"url":"https://bugzilla.suse.com/1280379","tags":["report"]},{"url":"https://bugzilla.suse.com/1280383","tags":["report"]},{"url":"https://bugzilla.suse.com/1280384","tags":["report"]},{"url":"https://bugzilla.suse.com/1280387","tags":["report"]},{"url":"https://bugzilla.suse.com/1280388","tags":["report"]},{"url":"https://bugzilla.suse.com/1280449","tags":["report"]},{"url":"https://bugzilla.suse.com/1280451","tags":["report"]},{"url":"https://bugzilla.suse.com/1280455","tags":["report"]},{"url":"https://bugzilla.suse.com/1280456","tags":["report"]},{"url":"https://bugzilla.suse.com/1280464","tags":["report"]},{"url":"https://bugzilla.suse.com/1280468","tags":["report"]},{"url":"https://bugzilla.suse.com/1280477","tags":["report"]},{"url":"https://bugzilla.suse.com/1280487","tags":["report"]},{"url":"https://bugzilla.suse.com/1280488","tags":["report"]},{"url":"https://bugzilla.suse.com/1280490","tags":["report"]},{"url":"https://bugzilla.suse.com/1280494","tags":["report"]},{"url":"https://bugzilla.suse.com/1280508","tags":["report"]},{"url":"https://bugzilla.suse.com/1280509","tags":["report"]},{"url":"https://bugzilla.suse.com/1280518","tags":["report"]},{"url":"https://bugzilla.suse.com/1280525","tags":["report"]},{"url":"https://bugzilla.suse.com/1280544","tags":["report"]},{"url":"https://bugzilla.suse.com/1280546","tags":["report"]},{"url":"https://bugzilla.suse.com/1280548","tags":["report"]},{"url":"https://bugzilla.suse.com/1280551","tags":["report"]},{"url":"https://bugzilla.suse.com/1280576","tags":["report"]},{"url":"https://bugzilla.suse.com/1280577","tags":["report"]},{"url":"https://bugzilla.suse.com/1280711","tags":["report"]},{"url":"https://bugzilla.suse.com/1280716","tags":["report"]},{"url":"https://bugzilla.suse.com/1280717","tags":["report"]},{"url":"https://bugzilla.suse.com/1280719","tags":["report"]},{"url":"https://bugzilla.suse.com/1280720","tags":["report"]},{"url":"https://bugzilla.suse.com/1280726","tags":["report"]},{"url":"https://bugzilla.suse.com/1280727","tags":["report"]},{"url":"https://bugzilla.suse.com/1280733","tags":["report"]},{"url":"https://bugzilla.suse.com/1280758","tags":["report"]},{"url":"https://bugzilla.suse.com/1280761","tags":["report"]},{"url":"https://bugzilla.suse.com/1280766","tags":["report"]},{"url":"https://bugzilla.suse.com/1280786","tags":["report"]},{"url":"https://bugzilla.suse.com/1280797","tags":["report"]},{"url":"https://bugzilla.suse.com/1280870","tags":["report"]},{"url":"https://bugzilla.suse.com/1280872","tags":["report"]},{"url":"https://bugzilla.suse.com/1280901","tags":["report"]},{"url":"https://bugzilla.suse.com/1280920","tags":["report"]},{"url":"https://bugzilla.suse.com/1280923","tags":["report"]},{"url":"https://bugzilla.suse.com/1280969","tags":["report"]},{"url":"https://bugzilla.suse.com/1280985","tags":["report"]},{"url":"https://bugzilla.suse.com/1280993","tags":["report"]},{"url":"https://bugzilla.suse.com/1281010","tags":["report"]},{"url":"https://bugzilla.suse.com/1281014","tags":["report"]},{"url":"https://bugzilla.suse.com/1281025","tags":["report"]},{"url":"https://bugzilla.suse.com/1281054","tags":["report"]},{"url":"https://bugzilla.suse.com/1281057","tags":["report"]},{"url":"https://bugzilla.suse.com/1281077","tags":["report"]},{"url":"https://bugzilla.suse.com/1281085","tags":["report"]},{"url":"https://bugzilla.suse.com/1281136","tags":["report"]},{"url":"https://bugzilla.suse.com/1281201","tags":["report"]},{"url":"https://bugzilla.suse.com/1281202","tags":["report"]},{"url":"https://bugzilla.suse.com/1281224","tags":["report"]},{"url":"https://bugzilla.suse.com/1281226","tags":["report"]},{"url":"https://bugzilla.suse.com/1281228","tags":["report"]},{"url":"https://bugzilla.suse.com/1281229","tags":["report"]},{"url":"https://bugzilla.suse.com/1281231","tags":["report"]},{"url":"https://bugzilla.suse.com/1281273","tags":["report"]},{"url":"https://bugzilla.suse.com/1281295","tags":["report"]},{"url":"https://bugzilla.suse.com/1281379","tags":["report"]},{"url":"https://bugzilla.suse.com/1281387","tags":["report"]},{"url":"https://bugzilla.suse.com/1281399","tags":["report"]},{"url":"https://bugzilla.suse.com/1281408","tags":["report"]},{"url":"https://bugzilla.suse.com/1281496","tags":["report"]},{"url":"https://bugzilla.suse.com/1281514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281525","tags":["report"]},{"url":"https://bugzilla.suse.com/1281546","tags":["report"]},{"url":"https://bugzilla.suse.com/1281597","tags":["report"]},{"url":"https://bugzilla.suse.com/1281599","tags":["report"]},{"url":"https://bugzilla.suse.com/1281644","tags":["report"]},{"url":"https://bugzilla.suse.com/1281645","tags":["report"]},{"url":"https://bugzilla.suse.com/1281660","tags":["report"]},{"url":"https://bugzilla.suse.com/1281680","tags":["report"]},{"url":"https://bugzilla.suse.com/1281682","tags":["report"]},{"url":"https://bugzilla.suse.com/1281683","tags":["report"]},{"url":"https://bugzilla.suse.com/1281717","tags":["report"]},{"url":"https://bugzilla.suse.com/1281732","tags":["report"]},{"url":"https://bugzilla.suse.com/1281738","tags":["report"]},{"url":"https://bugzilla.suse.com/1281754","tags":["report"]},{"url":"https://bugzilla.suse.com/1281777","tags":["report"]},{"url":"https://bugzilla.suse.com/1281778","tags":["report"]},{"url":"https://bugzilla.suse.com/1281786","tags":["report"]},{"url":"https://bugzilla.suse.com/1281789","tags":["report"]},{"url":"https://bugzilla.suse.com/1281795","tags":["report"]},{"url":"https://bugzilla.suse.com/1281808","tags":["report"]},{"url":"https://bugzilla.suse.com/1281825","tags":["report"]},{"url":"https://bugzilla.suse.com/1281845","tags":["report"]},{"url":"https://bugzilla.suse.com/1281922","tags":["report"]},{"url":"https://bugzilla.suse.com/1281955","tags":["report"]},{"url":"https://bugzilla.suse.com/1281956","tags":["report"]},{"url":"https://bugzilla.suse.com/1281964","tags":["report"]},{"url":"https://bugzilla.suse.com/1281973","tags":["report"]},{"url":"https://bugzilla.suse.com/1281991","tags":["report"]},{"url":"https://bugzilla.suse.com/1282003","tags":["report"]},{"url":"https://bugzilla.suse.com/1282013","tags":["report"]},{"url":"https://bugzilla.suse.com/1282020","tags":["report"]},{"url":"https://bugzilla.suse.com/1282050","tags":["report"]},{"url":"https://bugzilla.suse.com/1282054","tags":["report"]},{"url":"https://bugzilla.suse.com/1282072","tags":["report"]},{"url":"https://bugzilla.suse.com/1282104","tags":["report"]},{"url":"https://bugzilla.suse.com/1282110","tags":["report"]},{"url":"https://bugzilla.suse.com/1282113","tags":["report"]},{"url":"https://bugzilla.suse.com/1282143","tags":["report"]},{"url":"https://bugzilla.suse.com/1282147","tags":["report"]},{"url":"https://bugzilla.suse.com/1282197","tags":["report"]},{"url":"https://bugzilla.suse.com/1282270","tags":["report"]},{"url":"https://bugzilla.suse.com/1282271","tags":["report"]},{"url":"https://bugzilla.suse.com/1282288","tags":["report"]},{"url":"https://bugzilla.suse.com/1282648","tags":["report"]},{"url":"https://bugzilla.suse.com/1282672","tags":["report"]},{"url":"https://bugzilla.suse.com/1282747","tags":["report"]},{"url":"https://bugzilla.suse.com/1282774","tags":["report"]},{"url":"https://bugzilla.suse.com/1282803","tags":["report"]},{"url":"https://bugzilla.suse.com/1282808","tags":["report"]},{"url":"https://bugzilla.suse.com/1282812","tags":["report"]},{"url":"https://bugzilla.suse.com/1282823","tags":["report"]},{"url":"https://bugzilla.suse.com/1282881","tags":["report"]},{"url":"https://bugzilla.suse.com/1282891","tags":["report"]},{"url":"https://bugzilla.suse.com/1282906","tags":["report"]},{"url":"https://bugzilla.suse.com/1282975","tags":["report"]},{"url":"https://bugzilla.suse.com/1282997","tags":["report"]},{"url":"https://bugzilla.suse.com/1283119","tags":["report"]},{"url":"https://bugzilla.suse.com/1283130","tags":["report"]},{"url":"https://bugzilla.suse.com/1283149","tags":["report"]},{"url":"https://bugzilla.suse.com/1283154","tags":["report"]},{"url":"https://bugzilla.suse.com/1283163","tags":["report"]},{"url":"https://bugzilla.suse.com/1283166","tags":["report"]},{"url":"https://bugzilla.suse.com/1283173","tags":["report"]},{"url":"https://bugzilla.suse.com/1283176","tags":["report"]},{"url":"https://bugzilla.suse.com/1283201","tags":["report"]},{"url":"https://bugzilla.suse.com/1283203","tags":["report"]},{"url":"https://bugzilla.suse.com/1283205","tags":["report"]},{"url":"https://bugzilla.suse.com/1283213","tags":["report"]},{"url":"https://bugzilla.suse.com/1283230","tags":["report"]},{"url":"https://bugzilla.suse.com/1283296","tags":["report"]},{"url":"https://bugzilla.suse.com/1283312","tags":["report"]},{"url":"https://bugzilla.suse.com/1283328","tags":["report"]},{"url":"https://bugzilla.suse.com/1283450","tags":["report"]},{"url":"https://bugzilla.suse.com/1283475","tags":["report"]},{"url":"https://bugzilla.suse.com/1283479","tags":["report"]},{"url":"https://bugzilla.suse.com/1283489","tags":["report"]},{"url":"https://bugzilla.suse.com/1283490","tags":["report"]},{"url":"https://bugzilla.suse.com/1283517","tags":["report"]},{"url":"https://bugzilla.suse.com/1283739","tags":["report"]},{"url":"https://bugzilla.suse.com/1283794","tags":["report"]},{"url":"https://bugzilla.suse.com/1283795","tags":["report"]},{"url":"https://bugzilla.suse.com/1283805","tags":["report"]},{"url":"https://bugzilla.suse.com/1283880","tags":["report"]},{"url":"https://bugzilla.suse.com/1283906","tags":["report"]},{"url":"https://bugzilla.suse.com/1283945","tags":["report"]},{"url":"https://bugzilla.suse.com/1284146","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98091","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624181-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222538","tags":["report"]},{"url":"https://bugzilla.suse.com/1254408","tags":["report"]},{"url":"https://bugzilla.suse.com/1258298","tags":["report"]},{"url":"https://bugzilla.suse.com/1263017","tags":["report"]},{"url":"https://bugzilla.suse.com/1263602","tags":["report"]},{"url":"https://bugzilla.suse.com/1263865","tags":["report"]},{"url":"https://bugzilla.suse.com/1264807","tags":["report"]},{"url":"https://bugzilla.suse.com/1266735","tags":["report"]},{"url":"https://bugzilla.suse.com/1267373","tags":["report"]},{"url":"https://bugzilla.suse.com/1267564","tags":["report"]},{"url":"https://bugzilla.suse.com/1267648","tags":["report"]},{"url":"https://bugzilla.suse.com/1267985","tags":["report"]},{"url":"https://bugzilla.suse.com/1269000","tags":["report"]},{"url":"https://bugzilla.suse.com/1269685","tags":["report"]},{"url":"https://bugzilla.suse.com/1269816","tags":["report"]},{"url":"https://bugzilla.suse.com/1271906","tags":["report"]},{"url":"https://bugzilla.suse.com/1272426","tags":["report"]},{"url":"https://bugzilla.suse.com/1272471","tags":["report"]},{"url":"https://bugzilla.suse.com/1272572","tags":["report"]},{"url":"https://bugzilla.suse.com/1272793","tags":["report"]},{"url":"https://bugzilla.suse.com/1272847","tags":["report"]},{"url":"https://bugzilla.suse.com/1273251","tags":["report"]},{"url":"https://bugzilla.suse.com/1273309","tags":["report"]},{"url":"https://bugzilla.suse.com/1273339","tags":["report"]},{"url":"https://bugzilla.suse.com/1273420","tags":["report"]},{"url":"https://bugzilla.suse.com/1273522","tags":["report"]},{"url":"https://bugzilla.suse.com/1273750","tags":["report"]},{"url":"https://bugzilla.suse.com/1273759","tags":["report"]},{"url":"https://bugzilla.suse.com/1273776","tags":["report"]},{"url":"https://bugzilla.suse.com/1273782","tags":["report"]},{"url":"https://bugzilla.suse.com/1273870","tags":["report"]},{"url":"https://bugzilla.suse.com/1273899","tags":["report"]},{"url":"https://bugzilla.suse.com/1273953","tags":["report"]},{"url":"https://bugzilla.suse.com/1273999","tags":["report"]},{"url":"https://bugzilla.suse.com/1274010","tags":["report"]},{"url":"https://bugzilla.suse.com/1274036","tags":["report"]},{"url":"https://bugzilla.suse.com/1274494","tags":["report"]},{"url":"https://bugzilla.suse.com/1274637","tags":["report"]},{"url":"https://bugzilla.suse.com/1274730","tags":["report"]},{"url":"https://bugzilla.suse.com/1274803","tags":["report"]},{"url":"https://bugzilla.suse.com/1274838","tags":["report"]},{"url":"https://bugzilla.suse.com/1275092","tags":["report"]},{"url":"https://bugzilla.suse.com/1275094","tags":["report"]},{"url":"https://bugzilla.suse.com/1275129","tags":["report"]},{"url":"https://bugzilla.suse.com/1275156","tags":["report"]},{"url":"https://bugzilla.suse.com/1275455","tags":["report"]},{"url":"https://bugzilla.suse.com/1275542","tags":["report"]},{"url":"https://bugzilla.suse.com/1275588","tags":["report"]},{"url":"https://bugzilla.suse.com/1275681","tags":["report"]},{"url":"https://bugzilla.suse.com/1275684","tags":["report"]},{"url":"https://bugzilla.suse.com/1275685","tags":["report"]},{"url":"https://bugzilla.suse.com/1275690","tags":["report"]},{"url":"https://bugzilla.suse.com/1275694","tags":["report"]},{"url":"https://bugzilla.suse.com/1275799","tags":["report"]},{"url":"https://bugzilla.suse.com/1275802","tags":["report"]},{"url":"https://bugzilla.suse.com/1275866","tags":["report"]},{"url":"https://bugzilla.suse.com/1275985","tags":["report"]},{"url":"https://bugzilla.suse.com/1276006","tags":["report"]},{"url":"https://bugzilla.suse.com/1276339","tags":["report"]},{"url":"https://bugzilla.suse.com/1276341","tags":["report"]},{"url":"https://bugzilla.suse.com/1276354","tags":["report"]},{"url":"https://bugzilla.suse.com/1276381","tags":["report"]},{"url":"https://bugzilla.suse.com/1276395","tags":["report"]},{"url":"https://bugzilla.suse.com/1276445","tags":["report"]},{"url":"https://bugzilla.suse.com/1276468","tags":["report"]},{"url":"https://bugzilla.suse.com/1276473","tags":["report"]},{"url":"https://bugzilla.suse.com/1276512","tags":["report"]},{"url":"https://bugzilla.suse.com/1276528","tags":["report"]},{"url":"https://bugzilla.suse.com/1276547","tags":["report"]},{"url":"https://bugzilla.suse.com/1276553","tags":["report"]},{"url":"https://bugzilla.suse.com/1276572","tags":["report"]},{"url":"https://bugzilla.suse.com/1276766","tags":["report"]},{"url":"https://bugzilla.suse.com/1276767","tags":["report"]},{"url":"https://bugzilla.suse.com/1276793","tags":["report"]},{"url":"https://bugzilla.suse.com/1276801","tags":["report"]},{"url":"https://bugzilla.suse.com/1276803","tags":["report"]},{"url":"https://bugzilla.suse.com/1276814","tags":["report"]},{"url":"https://bugzilla.suse.com/1276818","tags":["report"]},{"url":"https://bugzilla.suse.com/1276821","tags":["report"]},{"url":"https://bugzilla.suse.com/1276840","tags":["report"]},{"url":"https://bugzilla.suse.com/1276865","tags":["report"]},{"url":"https://bugzilla.suse.com/1276866","tags":["report"]},{"url":"https://bugzilla.suse.com/1276876","tags":["report"]},{"url":"https://bugzilla.suse.com/1276880","tags":["report"]},{"url":"https://bugzilla.suse.com/1276891","tags":["report"]},{"url":"https://bugzilla.suse.com/1276905","tags":["report"]},{"url":"https://bugzilla.suse.com/1276922","tags":["report"]},{"url":"https://bugzilla.suse.com/1277023","tags":["report"]},{"url":"https://bugzilla.suse.com/1277070","tags":["report"]},{"url":"https://bugzilla.suse.com/1277078","tags":["report"]},{"url":"https://bugzilla.suse.com/1277092","tags":["report"]},{"url":"https://bugzilla.suse.com/1277108","tags":["report"]},{"url":"https://bugzilla.suse.com/1277114","tags":["report"]},{"url":"https://bugzilla.suse.com/1277115","tags":["report"]},{"url":"https://bugzilla.suse.com/1277120","tags":["report"]},{"url":"https://bugzilla.suse.com/1277148","tags":["report"]},{"url":"https://bugzilla.suse.com/1277179","tags":["report"]},{"url":"https://bugzilla.suse.com/1277229","tags":["report"]},{"url":"https://bugzilla.suse.com/1277231","tags":["report"]},{"url":"https://bugzilla.suse.com/1277233","tags":["report"]},{"url":"https://bugzilla.suse.com/1277235","tags":["report"]},{"url":"https://bugzilla.suse.com/1277249","tags":["report"]},{"url":"https://bugzilla.suse.com/1277254","tags":["report"]},{"url":"https://bugzilla.suse.com/1277268","tags":["report"]},{"url":"https://bugzilla.suse.com/1277308","tags":["report"]},{"url":"https://bugzilla.suse.com/1277321","tags":["report"]},{"url":"https://bugzilla.suse.com/1277328","tags":["report"]},{"url":"https://bugzilla.suse.com/1277335","tags":["report"]},{"url":"https://bugzilla.suse.com/1277349","tags":["report"]},{"url":"https://bugzilla.suse.com/1277350","tags":["report"]},{"url":"https://bugzilla.suse.com/1277505","tags":["report"]},{"url":"https://bugzilla.suse.com/1277513","tags":["report"]},{"url":"https://bugzilla.suse.com/1277544","tags":["report"]},{"url":"https://bugzilla.suse.com/1277553","tags":["report"]},{"url":"https://bugzilla.suse.com/1277561","tags":["report"]},{"url":"https://bugzilla.suse.com/1277571","tags":["report"]},{"url":"https://bugzilla.suse.com/1277574","tags":["report"]},{"url":"https://bugzilla.suse.com/1277590","tags":["report"]},{"url":"https://bugzilla.suse.com/1277649","tags":["report"]},{"url":"https://bugzilla.suse.com/1277655","tags":["report"]},{"url":"https://bugzilla.suse.com/1277656","tags":["report"]},{"url":"https://bugzilla.suse.com/1277728","tags":["report"]},{"url":"https://bugzilla.suse.com/1277738","tags":["report"]},{"url":"https://bugzilla.suse.com/1277748","tags":["report"]},{"url":"https://bugzilla.suse.com/1277761","tags":["report"]},{"url":"https://bugzilla.suse.com/1277764","tags":["report"]},{"url":"https://bugzilla.suse.com/1277783","tags":["report"]},{"url":"https://bugzilla.suse.com/1277796","tags":["report"]},{"url":"https://bugzilla.suse.com/1277813","tags":["report"]},{"url":"https://bugzilla.suse.com/1277818","tags":["report"]},{"url":"https://bugzilla.suse.com/1277822","tags":["report"]},{"url":"https://bugzilla.suse.com/1277837","tags":["report"]},{"url":"https://bugzilla.suse.com/1277860","tags":["report"]},{"url":"https://bugzilla.suse.com/1277862","tags":["report"]},{"url":"https://bugzilla.suse.com/1277874","tags":["report"]},{"url":"https://bugzilla.suse.com/1277876","tags":["report"]},{"url":"https://bugzilla.suse.com/1277898","tags":["report"]},{"url":"https://bugzilla.suse.com/1277901","tags":["report"]},{"url":"https://bugzilla.suse.com/1277908","tags":["report"]},{"url":"https://bugzilla.suse.com/1277918","tags":["report"]},{"url":"https://bugzilla.suse.com/1278070","tags":["report"]},{"url":"https://bugzilla.suse.com/1278088","tags":["report"]},{"url":"https://bugzilla.suse.com/1278094","tags":["report"]},{"url":"https://bugzilla.suse.com/1278098","tags":["report"]},{"url":"https://bugzilla.suse.com/1278108","tags":["report"]},{"url":"https://bugzilla.suse.com/1278113","tags":["report"]},{"url":"https://bugzilla.suse.com/1278132","tags":["report"]},{"url":"https://bugzilla.suse.com/1278155","tags":["report"]},{"url":"https://bugzilla.suse.com/1278178","tags":["report"]},{"url":"https://bugzilla.suse.com/1278180","tags":["report"]},{"url":"https://bugzilla.suse.com/1278210","tags":["report"]},{"url":"https://bugzilla.suse.com/1278211","tags":["report"]},{"url":"https://bugzilla.suse.com/1278233","tags":["report"]},{"url":"https://bugzilla.suse.com/1278236","tags":["report"]},{"url":"https://bugzilla.suse.com/1278240","tags":["report"]},{"url":"https://bugzilla.suse.com/1278253","tags":["report"]},{"url":"https://bugzilla.suse.com/1278293","tags":["report"]},{"url":"https://bugzilla.suse.com/1278294","tags":["report"]},{"url":"https://bugzilla.suse.com/1278324","tags":["report"]},{"url":"https://bugzilla.suse.com/1278331","tags":["report"]},{"url":"https://bugzilla.suse.com/1278335","tags":["report"]},{"url":"https://bugzilla.suse.com/1278395","tags":["report"]},{"url":"https://bugzilla.suse.com/1278416","tags":["report"]},{"url":"https://bugzilla.suse.com/1278716","tags":["report"]},{"url":"https://bugzilla.suse.com/1278733","tags":["report"]},{"url":"https://bugzilla.suse.com/1279422","tags":["report"]},{"url":"https://bugzilla.suse.com/1279487","tags":["report"]},{"url":"https://bugzilla.suse.com/1279580","tags":["report"]},{"url":"https://bugzilla.suse.com/1279619","tags":["report"]},{"url":"https://bugzilla.suse.com/1279811","tags":["report"]},{"url":"https://bugzilla.suse.com/1279813","tags":["report"]},{"url":"https://bugzilla.suse.com/1279847","tags":["report"]},{"url":"https://bugzilla.suse.com/1280139","tags":["report"]},{"url":"https://bugzilla.suse.com/1280496","tags":["report"]},{"url":"https://bugzilla.suse.com/1280750","tags":["report"]},{"url":"https://bugzilla.suse.com/1281042","tags":["report"]},{"url":"https://bugzilla.suse.com/1281046","tags":["report"]},{"url":"https://bugzilla.suse.com/1281358","tags":["report"]},{"url":"https://bugzilla.suse.com/1281359","tags":["report"]},{"url":"https://bugzilla.suse.com/1281383","tags":["report"]},{"url":"https://bugzilla.suse.com/1281397","tags":["report"]},{"url":"https://bugzilla.suse.com/1281427","tags":["report"]},{"url":"https://bugzilla.suse.com/1281694","tags":["report"]},{"url":"https://bugzilla.suse.com/1281793","tags":["report"]},{"url":"https://bugzilla.suse.com/1281818","tags":["report"]},{"url":"https://bugzilla.suse.com/1281927","tags":["report"]},{"url":"https://bugzilla.suse.com/1281988","tags":["report"]},{"url":"https://bugzilla.suse.com/1281993","tags":["report"]},{"url":"https://bugzilla.suse.com/1281995","tags":["report"]},{"url":"https://bugzilla.suse.com/1281997","tags":["report"]},{"url":"https://bugzilla.suse.com/1282034","tags":["report"]},{"url":"https://bugzilla.suse.com/1282040","tags":["report"]},{"url":"https://bugzilla.suse.com/1282041","tags":["report"]},{"url":"https://bugzilla.suse.com/1282042","tags":["report"]},{"url":"https://bugzilla.suse.com/1282170","tags":["report"]},{"url":"https://bugzilla.suse.com/1282193","tags":["report"]},{"url":"https://bugzilla.suse.com/1282284","tags":["report"]},{"url":"https://bugzilla.suse.com/1282286","tags":["report"]},{"url":"https://bugzilla.suse.com/1282383","tags":["report"]},{"url":"https://bugzilla.suse.com/1282767","tags":["report"]},{"url":"https://bugzilla.suse.com/1282810","tags":["report"]},{"url":"https://bugzilla.suse.com/1283121","tags":["report"]},{"url":"https://bugzilla.suse.com/1283500","tags":["report"]},{"url":"https://bugzilla.suse.com/1283935","tags":["report"]},{"url":"https://bugzilla.suse.com/1283973","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98164","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624182-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266008","tags":["report"]},{"url":"https://bugzilla.suse.com/1269532","tags":["report"]},{"url":"https://bugzilla.suse.com/1271955","tags":["report"]},{"url":"https://bugzilla.suse.com/1275540","tags":["report"]},{"url":"https://bugzilla.suse.com/1276277","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72084","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624184-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624197-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624235-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624315-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624316-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264640-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250951","tags":["report"]},{"url":"https://bugzilla.suse.com/1267882","tags":["report"]},{"url":"https://bugzilla.suse.com/1272971","tags":["report"]},{"url":"https://bugzilla.suse.com/1274900","tags":["report"]},{"url":"https://bugzilla.suse.com/1275238","tags":["report"]},{"url":"https://bugzilla.suse.com/1275680","tags":["report"]},{"url":"https://bugzilla.suse.com/1275801","tags":["report"]},{"url":"https://bugzilla.suse.com/1275804","tags":["report"]},{"url":"https://bugzilla.suse.com/1275812","tags":["report"]},{"url":"https://bugzilla.suse.com/1275956","tags":["report"]},{"url":"https://bugzilla.suse.com/1276471","tags":["report"]},{"url":"https://bugzilla.suse.com/1277407","tags":["report"]},{"url":"https://bugzilla.suse.com/1277451","tags":["report"]},{"url":"https://bugzilla.suse.com/1277535","tags":["report"]},{"url":"https://bugzilla.suse.com/1277773","tags":["report"]},{"url":"https://bugzilla.suse.com/1277845","tags":["report"]},{"url":"https://bugzilla.suse.com/1278709","tags":["report"]},{"url":"https://bugzilla.suse.com/1280239","tags":["report"]},{"url":"https://bugzilla.suse.com/1280927","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90047","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264660-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269136","tags":["report"]},{"url":"https://bugzilla.suse.com/1277742","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72301","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264665-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252682","tags":["report"]},{"url":"https://bugzilla.suse.com/1253005","tags":["report"]},{"url":"https://bugzilla.suse.com/1254633","tags":["report"]},{"url":"https://bugzilla.suse.com/1275304","tags":["report"]},{"url":"https://bugzilla.suse.com/1275307","tags":["report"]},{"url":"https://bugzilla.suse.com/1275470","tags":["report"]},{"url":"https://bugzilla.suse.com/1275535","tags":["report"]},{"url":"https://bugzilla.suse.com/1275696","tags":["report"]},{"url":"https://bugzilla.suse.com/1281360","tags":["report"]},{"url":"https://bugzilla.suse.com/1282932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-50645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93787","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264666-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216813","tags":["report"]},{"url":"https://bugzilla.suse.com/1235133","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56644","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264667-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264668-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264687-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1031492","tags":["report"]},{"url":"https://bugzilla.suse.com/1045298","tags":["report"]},{"url":"https://bugzilla.suse.com/1263133","tags":["report"]},{"url":"https://bugzilla.suse.com/1265138","tags":["report"]},{"url":"https://bugzilla.suse.com/1266412","tags":["report"]},{"url":"https://bugzilla.suse.com/1267990","tags":["report"]},{"url":"https://bugzilla.suse.com/1268276","tags":["report"]},{"url":"https://bugzilla.suse.com/1269081","tags":["report"]},{"url":"https://bugzilla.suse.com/1269131","tags":["report"]},{"url":"https://bugzilla.suse.com/1269234","tags":["report"]},{"url":"https://bugzilla.suse.com/1271834","tags":["report"]},{"url":"https://bugzilla.suse.com/1272211","tags":["report"]},{"url":"https://bugzilla.suse.com/1272472","tags":["report"]},{"url":"https://bugzilla.suse.com/1272480","tags":["report"]},{"url":"https://bugzilla.suse.com/1272499","tags":["report"]},{"url":"https://bugzilla.suse.com/1272517","tags":["report"]},{"url":"https://bugzilla.suse.com/1272522","tags":["report"]},{"url":"https://bugzilla.suse.com/1272523","tags":["report"]},{"url":"https://bugzilla.suse.com/1272642","tags":["report"]},{"url":"https://bugzilla.suse.com/1273023","tags":["report"]},{"url":"https://bugzilla.suse.com/1273302","tags":["report"]},{"url":"https://bugzilla.suse.com/1273480","tags":["report"]},{"url":"https://bugzilla.suse.com/1273600","tags":["report"]},{"url":"https://bugzilla.suse.com/1273603","tags":["report"]},{"url":"https://bugzilla.suse.com/1273769","tags":["report"]},{"url":"https://bugzilla.suse.com/1273868","tags":["report"]},{"url":"https://bugzilla.suse.com/1274011","tags":["report"]},{"url":"https://bugzilla.suse.com/1274026","tags":["report"]},{"url":"https://bugzilla.suse.com/1274682","tags":["report"]},{"url":"https://bugzilla.suse.com/1274831","tags":["report"]},{"url":"https://bugzilla.suse.com/1274869","tags":["report"]},{"url":"https://bugzilla.suse.com/1274981","tags":["report"]},{"url":"https://bugzilla.suse.com/1275954","tags":["report"]},{"url":"https://bugzilla.suse.com/1275957","tags":["report"]},{"url":"https://bugzilla.suse.com/1275958","tags":["report"]},{"url":"https://bugzilla.suse.com/1275959","tags":["report"]},{"url":"https://bugzilla.suse.com/1276257","tags":["report"]},{"url":"https://bugzilla.suse.com/1276321","tags":["report"]},{"url":"https://bugzilla.suse.com/1276335","tags":["report"]},{"url":"https://bugzilla.suse.com/1276495","tags":["report"]},{"url":"https://bugzilla.suse.com/1276585","tags":["report"]},{"url":"https://bugzilla.suse.com/1276925","tags":["report"]},{"url":"https://bugzilla.suse.com/1276934","tags":["report"]},{"url":"https://bugzilla.suse.com/1277064","tags":["report"]},{"url":"https://bugzilla.suse.com/1277265","tags":["report"]},{"url":"https://bugzilla.suse.com/1277485","tags":["report"]},{"url":"https://bugzilla.suse.com/1277881","tags":["report"]},{"url":"https://bugzilla.suse.com/1278310","tags":["report"]},{"url":"https://bugzilla.suse.com/1279485","tags":["report"]},{"url":"https://bugzilla.suse.com/1279627","tags":["report"]},{"url":"https://bugzilla.suse.com/1279809","tags":["report"]},{"url":"https://bugzilla.suse.com/1279812","tags":["report"]},{"url":"https://bugzilla.suse.com/1280223","tags":["report"]},{"url":"https://bugzilla.suse.com/1280230","tags":["report"]},{"url":"https://bugzilla.suse.com/1280581","tags":["report"]},{"url":"https://bugzilla.suse.com/1281176","tags":["report"]},{"url":"https://bugzilla.suse.com/1281352","tags":["report"]},{"url":"https://bugzilla.suse.com/1281429","tags":["report"]},{"url":"https://bugzilla.suse.com/1281708","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90223","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264706-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74609","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8878-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8879-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8877-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8875-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8886-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8875-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8959-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8963-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-54125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-54271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74657","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-10263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74621","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74655","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80896","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89621","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89655","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89657","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89896","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-90435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-92525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97438","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97621","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98426","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98442","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98554","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98621","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98896","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-100079","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8960-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-49234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-49359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-49562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-49651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-49858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-50071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-50303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-50406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-53231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-53320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-53707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-54683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-52988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-98890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-74609","title":"tipc: read le-\u003elink under the node lock in tipc_node_link_down()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T15:31:56.054Z","modified":"2026-10-16T19:06:01.059Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:20:03.081354Z"}],"euvd":[{"id":"EUVD-2026-64546","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T15:31:56Z","modified":"2026-10-16T19:06:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:02.396845Z"}],"ghsa":[{"id":"GHSA-c6xm-fh9c-399h","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T18:30:26Z","modified":"2026-08-25T06:31:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:10:56.141217Z"}],"nvd":[{"id":"CVE-2026-74609","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T16:16:33.407Z","modified":"2026-10-16T20:17:46.07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"BELL-CVE-2026-74609","status":"published","published":"2026-08-27T06:10:27.945758Z","modified":"2026-10-07T07:15:56.344871626Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-74609","title":"tipc: read le-\u003elink under the node lock in tipc_node_link_down()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T15:31:56.054Z","modified":"2026-10-28T02:31:09.249079604Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:16.748692Z"},{"id":"DEBIAN-CVE-2026-74609","description":"In the Linux kernel, the following vulnerability has been resolved:  tipc: read le-\u003elink under the node lock in tipc_node_link_down()  tipc_node_link_down() caches the link pointer before taking n-\u003elock:  \tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */  \tif (!l) \t\treturn; \ttipc_node_write_lock(n); \tif (!tipc_link_is_establishing(l)) {\t/* deref l */ \t... \t\ttipc_link_reset(l);\t\t/* write into l */ \tif (delete) { \t\tkfree(l); \t\tle-\u003elink = NULL;  The delete=true caller frees that very object under n-\u003elock, so the lock does not protect the cached pointer against it:   - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link    supervision timer via tipc_node_timeout(), reads l unlocked and then    dereferences it under n-\u003elock;  - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()    -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)    -\u003e kfree(l).  The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone.  An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.  The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:    BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)   Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0    tipc_link_is_establishing (net/tipc/link.c:285)    tipc_node_link_down (net/tipc/node.c:1076)    tipc_node_timeout (net/tipc/node.c:843)   Allocated by task 9549:    tipc_link_create (net/tipc/link.c:490)    tipc_node_check_dest (net/tipc/node.c:1279)    tipc_disc_rcv (net/tipc/discover.c:252)    tipc_udp_recv (net/tipc/udp_media.c:389)   Freed by task 9549:    tipc_node_link_down (net/tipc/node.c:1084)    tipc_node_delete_links (net/tipc/node.c:1320)    bearer_disable (net/tipc/bearer.c:414)    __tipc_nl_bearer_disable (net/tipc/bearer.c:992)  Move the le-\u003elink read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path.  A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T16:16:33.407Z","modified":"2026-10-23T18:05:16.842502836Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:03.004924Z"},{"id":"OESA-2026-3707","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently.(CVE-2026-31668)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\n\nThe current implementation incorrectly handles memory regions (MRs) with\npage sizes different from the system PAGE_SIZE. The core issue is that\nrxe_set_page() is called with mr-\u0026gt;page_size step increments, but the\npage_list stores individual struct page pointers, each representing\nPAGE_SIZE of memory.\n\nib_sg_to_page() has ensured that when i\u0026gt;=1 either\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\nor\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u0026gt;page_size aligned.\n\nThis leads to incorrect iova-to-va conversion in scenarios:\n\n1) page_size \u0026lt; PAGE_SIZE (e.g., MR: 4K, system: 64K):\n   ibmr-\u0026gt;iova = 0x181800\n   sg[0]: dma_addr=0x181800, len=0x800\n   sg[1]: dma_addr=0x173000, len=0x1000\n\n   Access iova = 0x181800 + 0x810 = 0x182010\n   Expected VA: 0x173010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x182010 \u0026gt;\u0026gt; 12) - (0x181800 \u0026gt;\u0026gt; 12) = 1\n     - page_offset = 0x182010 \u0026amp; 0xFFF = 0x10\n     - xarray[1] stores system page base 0x170000\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\n\n2) page_size \u0026gt; PAGE_SIZE (e.g., MR: 64K, system: 4K):\n   ibmr-\u0026gt;iova = 0x18f800\n   sg[0]: dma_addr=0x18f800, len=0x800\n   sg[1]: dma_addr=0x170000, len=0x1000\n\n   Access iova = 0x18f800 + 0x810 = 0x190010\n   Expected VA: 0x170010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x190010 \u0026gt;\u0026gt; 16) - (0x18f800 \u0026gt;\u0026gt; 16) = 1\n     - page_offset = 0x190010 \u0026amp; 0xFFFF = 0x10\n     - xarray[1] stores system page for dma_addr 0x170000\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\n\nYi Zhang reported a kernel panic[1] years ago related to this defect.\n\nSolution:\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\n   indexing (all MR page indices are contiguous)\n2. Each rxe_mr_page stores both struct page* and offset within the\n   system page\n3. Handle MR page_size != PAGE_SIZE relationships:\n   - page_size \u0026gt; PAGE_SIZE: Split MR pages into multiple system pages\n   - page_size \u0026lt;= PAGE_SIZE: Store offset within system page\n4. Add boundary checks and compatibility validation\n\nThis ensures correct iova-to-va conversion regardless of MR page size\nand system PAGE_SIZE relationship, while improving performance through\narray-based sequential access.\n\nTests on 4K and 64K PAGE_SIZE hosts:\n- rdma-core/pytests\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\n- blktest:\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\n\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/(CVE-2026-46325)\n\nIn the Linux kernel, compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task\u0026apos;s pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task\u0026apos;s register state on error.(CVE-2026-64082)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n\nhci_abort_conn() read hci_skb_event(hdev-\u0026gt;sent_cmd) when a connection\nwas pending, but hdev-\u0026gt;sent_cmd can be NULL while req_status is still\nHCI_REQ_PEND, leading to a NULL pointer dereference and a general\nprotection fault from the hci_rx_work() receive path.\n\nInstead of inspecting hdev-\u0026gt;sent_cmd, track the in-flight create\nconnection command with a new per-connection HCI_CONN_CREATE flag and\nroute all cancellation through hci_cancel_connect_sync(), which\ndispatches to a dedicated per-type cancel function. The create command\nis in exactly one of two states: still queued, or in flight. The cancel\nfunction holds cmd_sync_work_lock across the whole decision: the worker\ntakes this lock to dequeue every entry, so while it is held a queued\ncommand cannot start running and an in-flight command cannot complete\nand let the next command become pending. This keeps the flag test and\nhci_cmd_sync_cancel() atomic with respect to the worker, so a queued\ncommand is simply dequeued, and an in-flight command owned by this\nconnection is cancelled without the risk of cancelling an unrelated\ncommand that became pending in the meantime. CIS uses the same flag\nmechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.\n\nhci_acl_create_conn_sync() and hci_le_create_conn_sync() clear\nHCI_CONN_CREATE after the create command completes, but the command\nstatus handler can free conn via hci_conn_del() (for example when the\ncontroller rejects the connection) while the worker is still blocked on\nthe connection complete event. Hold a reference on conn across the\ncreate command so the flag can be cleared without a use-after-free.(CVE-2026-64405)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq-\u0026gt;hr_sk-\u0026gt;sk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock-\u0026gt;file: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock-\u0026gt;file during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path.  Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use.  When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch.(CVE-2026-64523)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n   check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n   internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n   OSD sends struct_len=0, ceph_start_decoding() returns success with\n   p == end. The immediately following bare ceph_decode_32(p) then reads\n   4 bytes past the validated buffer boundary. The garbage value is\n   passed directly to kzalloc_objs() as the locker count.\n\n   The sibling function decode_watchers() in osd_client.c already uses\n   ceph_decode_32_safe() after its own ceph_start_decoding() call.\n   decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n   bounds check. If an OSD crafts num_lockers such that the loop\n   advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n   one byte past the validated buffer boundary. The result is passed\n   directly into *type, which is used as a lock type discriminator by\n   callers, giving an OSD-controlled one-byte OOB read with direct\n   influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n  ceph_decode_32(p) -\u0026gt; ceph_decode_32_safe(p, end, *num_lockers,\n                                           err_inval)\n  ceph_decode_8(p)  -\u0026gt; ceph_decode_8_safe(p, end, *type,\n                                          err_free_lockers)\n\nThe goto targets differ intentionally:\n  err_inval: is a new label returning -EINVAL directly. It is used for\n  the pre-allocation failure path where *lockers is not yet allocated\n  and must not be passed to ceph_free_lockers().\n\n  err_free_lockers: is the existing label. It is used for the\n  post-allocation failure path where *lockers is allocated and must\n  be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ](CVE-2026-68082)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order.  Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it.  Use the request socket\u0026apos;s send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response.(CVE-2026-68118)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\u0026quot;net-gro: Fix GRO flush when receiving a GSO\npacket.\u0026quot;) added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u0026gt;flush may still be\nre-aggregated.\n\nThis allows already-GRO\u0026apos;d packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n  1. Driver: Generated aggregated packet P1 via LRO with frag_list\n  2. Dev A: Receives aggregated fraglist packet and flush flag set\n  3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n  4. Missing flush check allows re-aggregation despite flush flag\n  5. Frag_list chain becomes corrupted (loops or dangling refs)\n  6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n  The check at line ~4891:\n    if (hsize \u0026lt;= 0 \u0026amp;\u0026amp; i \u0026gt;= nfrags \u0026amp;\u0026amp; skb_headlen(list_skb) \u0026amp;\u0026amp;\n        (skb_headlen(list_skb) == len || sg)) {\n\n  When frag_list is corrupted by double aggregation, when list_skb is\n  a NULL pointer from skb-\u0026gt;next, skb_headlen(list_skb) dereference\n  NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u0026gt;flush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive().(CVE-2026-68136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic \u0026apos;int refcnt\u0026apos; with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u0026gt; tcf_action_init() -\u0026gt; tcf_action_init_1() -\u0026gt;\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n  BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n   qdisc_put_rtab+0x12f/0x160\n   tcf_police_init+0xda9/0x1590\n   tcf_action_init_1+0x460/0x6b0\n   tcf_action_init+0x439/0xa40\n   tcf_exts_validate_ex+0x42d/0x550\n   fl_change+0xddd/0x7da0\n   tc_new_tfilter+0xaa7/0x2420\n   rtnetlink_rcv_msg+0x95e/0xe90\n  which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock.(CVE-2026-68138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) \u0026gt;\u0026gt; i_blkbits.  When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs-\u0026gt;state allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op.(CVE-2026-68145)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n  Write of size 4 ... by task exploit\n   kasan_report (mm/kasan/report.c:595)\n   ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n   calc_target (net/ceph/osd_client.c:1638)\n   __submit_request (net/ceph/osd_client.c:2394)\n   ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n   ceph_osdc_call (net/ceph/osd_client.c:5164)\n   rbd_dev_image_probe (drivers/block/rbd.c:6899)\n   do_rbd_add (drivers/block/rbd.c:7138)\n   ...\n  kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ](CVE-2026-68159)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()\n\nThe v4l2 helper v4l2_async_register_subdev_sensor() calls\nv4l2_async_register_subdev(), which is a macro that expands to\n__v4l2_async_register_subdev(sd,THIS_MODULE). Since the macro is expanded\ninside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module\nrather than the sensor driver module that originally set sd-\u0026gt;owner. When\nv4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which then\noverwrites the sensor driver\u0026apos;s owner with NULL.\n\nThis causes the problem that the sensor module\u0026apos;s reference count is never\nincremented during async registration, so the module can be removed while\nthe subdevice is still in use by a notifier (e.g., a CSI-2 receiver\nbridge driver).\n\nFix this by renaming v4l2_async_register_subdev_sensor() to\n__v4l2_async_register_subdev_sensor() with an added explicit module\nargument and introducing a wrapper macro:\n    #define v4l2_async_register_subdev_sensor(sd) \\\n        __v4l2_async_register_subdev_sensor(sd, THIS_MODULE)\n\nThis ensures the sensor driver module is properly referenced even when\nthe sensor driver does not init the owner field before calling\nv4l2_async_register_subdev_sensor() and prevents premature module removal.(CVE-2026-68205)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u0026gt;prev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u0026gt;prev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u0026gt;prev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u0026gt;xmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u0026gt;prev is never updated.  If the\nlast segment is the one stolen, the returned head still has -\u0026gt;prev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed.  validate_xmit_skb_list() later does tail-\u0026gt;next = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u0026gt;prev at the last retained segment before returning.(CVE-2026-68426)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment](CVE-2026-68471)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere\u0026apos;s a buffer overflow in dm-verity-fec:\n\nif (neras \u0026amp;\u0026amp; *neras \u0026lt;= v-\u0026gt;fec-\u0026gt;roots)\n\tfio-\u0026gt;erasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 — one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer.(CVE-2026-72098)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register bounds before narrowing retval range in check_mem_access()\n\nWhen the BPF verifier processes a context load of an LSM hook return\nvalue, it calls __mark_reg_s32_range() to narrow the register to the\nhook\u0026apos;s valid range. However, __mark_reg_s32_range() intersects the new\nrange with the register\u0026apos;s existing bounds using max_t()/min_t() rather\nthan replacing them.\n\nIf the destination register carries stale bounds from a prior instruction\n(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than\nreality. The verifier then believes it knows the register\u0026apos;s exact value,\nwhile at runtime the actual hook return value is loaded, creating a\nverifier/runtime mismatch that can be used to bypass BPF memory safety\nchecks.\n\nThe else branch already calls mark_reg_unknown() to reset register state\nbefore any narrowing. Apply the same reset in the is_retval path so\nstale bounds are cleared before __mark_reg_s32_range() intersects.(CVE-2026-72111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch\n\nIn alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd\nand non-rsvd hugetlb cgroup charges.  When map_chg is set,\nhugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but\nthe immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg\nwith the non-rsvd cgroup pointer.\n\nAs a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong\n(non-rsvd) cgroup pointer into the folio\u0026apos;s rsvd slot.\n\nWhen the folio is later freed, free_huge_folio() unconditionally calls\nboth hugetlb_cgroup_uncharge_folio() and\nhugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the\nwrong cgroup from the folio and decrements a counter that was never\ncharged for that cgroup, causing a page_counter underflow:\n\n  page_counter underflow: -512 nr_pages=512\n  WARNING: mm/page_counter.c:61 at page_counter_cancel\n\nFix this by introducing a separate h_cg_rsvd pointer exclusively for the\nrsvd charge path, keeping the rsvd and non-rsvd charges fully independent\nthrough their charge, commit, and error uncharge paths.(CVE-2026-72213)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: fix zone comparison in tuple dedup\n\nThe \u0026quot;already exists\u0026quot; dedup logic in __nf_conncount_add() decides\nwhether a connection has already been counted and can be skipped instead\nof incrementing the connlimit count.  It compares the conntrack zone of a\nlist entry with the zone of the connection being added using\nnf_ct_zone_id() and nf_ct_zone_equal(), passing conn-\u0026gt;zone.dir or\nzone-\u0026gt;dir as the direction argument.\n\nThose helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0\nand IP_CT_DIR_REPLY is 1.  However, zone-\u0026gt;dir is a u8 bitmask:\nNF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and\nNF_CT_DEFAULT_ZONE_DIR is 3.  Passing that bitmask as the enum direction\nshifts the meaning of every non-zero value.  An ORIG-only zone passes 1\nand is tested as REPLY, while REPL-only and default zones pass 2 or 3 and\ntest bits beyond the valid direction range.  In those cases\nnf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using\nthe real zone id, so different zones can be treated as equal and dedup\ncollapses to tuple equality alone.\n\nnf_conncount stores and compares the original-direction tuple for a\nconnection.  If an skb already has an attached conntrack entry,\nget_ct_or_tuple_from_skb() explicitly copies\nct-\u0026gt;tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet\u0026apos;s\nctinfo.  Therefore the zone comparison in the tuple dedup path must use\nIP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a\nzone id applies, not which direction this conncount tuple represents.\n\nFix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.\nDo not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone\nids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the\ndirection-aware NF_CT_DEFAULT_ZONE_ID fallback.  A default bidirectional\nzone contains the ORIG bit, so it naturally returns the real zone id;\nreply-only zones continue to fall back for original-direction tuple\ncomparisons.(CVE-2026-72247)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling\n\nHyunwoo Kim reports some really bad races should the following\nsituation occur:\n\n- LPI-I is pending in vcpu-B\u0026apos;s AP list\n- vcpu-A writes to vcpu-B\u0026apos;s RD to disable its LPIs\n- vcpu-C moves I from B to C\n\nIf the last two race nicely enough, vgic_prune_ap_list() can drop\nthe irq and AP list locks, reacquire them, and in the interval\nthe irq has been freed. UAF follows.\n\nThe fix is two-fold:\n\n- Before dropping the irq and ap_list locks, take a reference on\n  the irq\n\n- Do not try to handle migration of the pending bit: there is no\n  expectation that this state is retained, as per the architecture\n\nWith that, we\u0026apos;re sure that the interrupt is still around, and we\nsafely remove it from the AP list as it has no target at this\nstage (unless another interrupt fires, but that\u0026apos;s another story).(CVE-2026-72288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()\n\nFunction kvm_vcpu_ioctl_interrupt() can be called from userspace, here\nadd irq validility cheking in kvm_vcpu_ioctl_interrupt().(CVE-2026-72294)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026amp;im-\u0026gt;refcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u0026gt; for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u0026gt; igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026amp;im-\u0026gt;refcnt),\nand deferring the put until after the spinlock is released.(CVE-2026-72321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup.(CVE-2026-72329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk-\u0026gt;chunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer.(CVE-2026-72398)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()\n\nTIPC UDP media bearer teardown calls dst_cache_destroy() on its\nreplicast caches before calling synchronize_net() to wait for\nconcurrent RCU readers (transmitters) to finish:\n\nstatic void cleanup_bearer(struct work_struct *work)\n{\n...\n\tlist_for_each_entry_safe(rcast, tmp, \u0026amp;ub-\u0026gt;rcast.list, list) {\n\t\tdst_cache_destroy(\u0026amp;rcast-\u0026gt;dst_cache);\n\t\tlist_del_rcu(\u0026amp;rcast-\u0026gt;list);\n\t\tkfree_rcu(rcast, rcu);\n\t}\n...\n\tdst_cache_destroy(\u0026amp;ub-\u0026gt;rcast.dst_cache);\n\tudp_tunnel_sock_release(ub-\u0026gt;sk);\n\tsynchronize_net();\n...\n}\n\nThis is highly buggy because dst_cache_destroy() immediately frees the\nper-CPU cache memory (free_percpu()) and releases the cached dst\nentries without any synchronization.\n\nIf a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another\nCPU under RCU protection, it can call dst_cache_get() concurrently,\nleading to:\n1. Use-After-Free on the per-CPU cache pointer itself (crash).\n2. \u0026quot;rcuref - imbalanced put()\u0026quot; warning if it attempts to release a\n   dst that was concurrently released by dst_cache_destroy().\n\nFurthermore, calling kfree(ub) immediately after synchronize_net() without\nclosing the socket first (or waiting after closing it) leaves a window\nwhere a concurrent receiver (tipc_udp_recv()) could start after\nsynchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.\n\nTo fix this, we must defer dst_cache_destroy() and kfree(ub) until after\nwe have ensured that no more readers can see the bearer/socket and all\nexisting readers have finished:\n\n1. Defer rcast entry destruction (both dst_cache_destroy() and kfree())\n   to an RCU callback using call_rcu_hurry().\n   Using call_rcu_hurry() ensures the dst entries are released quickly.\n\n2. Release the bearer socket using udp_tunnel_sock_release() (stops\n   new receive readers).\n\n3. Call synchronize_net() to wait for all outstanding RCU readers\n   (both transmit and receive) to finish.\n\n4. Now that it is safe, call dst_cache_destroy() on the main bearer\n   cache, and free ub.\n\nNote: 3) and 4) can be changed later in net-next to also use\ncall_rcu_hurry() and get rid of the synchronize_net() latency.(CVE-2026-72404)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync\n\nYue Sun reported a use-after-free and debugobjects warning in\nudp_tunnel_nic_device_sync_work() during concurrent device operations.\n\nThe workqueue core clears the internal pending bit before invoking the\nworker. At that point, a concurrent thread can queue the work again.\nWhen the already running worker eventually clears the work_pending flag\nto 0, it mistakenly clears the flag for the newly queued instance.\nudp_tunnel_nic_unregister() then observes work_pending as 0 and frees\nthe structure while the second work item is still active in the queue,\nleading to UAF.\n\nFix this by returning early in udp_tunnel_nic_device_sync() if\nwork_pending is already set, preventing redundant work queueing.(CVE-2026-72405)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix err_chunk memory leaks in INIT handling\n\nWhen sctp_verify_init() encounters unrecognized parameters, it allocates an\nerr_chunk to report them. However, this chunk is leaked in several code\npaths:\n\n1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after\n   sctp_verify_init() has populated err_chunk, the function returns\n   immediately without freeing it.\n\n2. In sctp_sf_do_unexpected_init(), the same leak occurs on the\n   security_sctp_assoc_request() failure path.\n\n3. In sctp_sf_do_unexpected_init(), on the success path after copying\n   unrecognized parameters to the INIT-ACK, the function returns without\n   freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees\n   it.\n\nFix all three leaks by adding sctp_chunk_free(err_chunk) calls before\nreturning in the error paths and on the success path in\nsctp_sf_do_unexpected_init().(CVE-2026-72413)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid R5_Overlap races while breaking stripe batches\n\nKCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()\non sh-\u0026gt;dev[i].flags (plain word write vs. atomic bit op)..\n\nand .. one possible scenario is:\n\nCPU1                            CPU2\nbreak_stripe_batch_list(sh1)\n-\u0026gt; handle sh2\n-\u0026gt; lock(sh2)\n-\u0026gt; sh2-\u0026gt;batch_head = NULL\n-\u0026gt; unlock(sh2)\n-\u0026gt; test_and_clear_bit(R5_Overlap, sh2-\u0026gt;dev[i].flags)\n-\u0026gt; wake_up_bit(sh2-\u0026gt;dev[i].flags)\n                                raid5_make_request()\n                                -\u0026gt; add_all_stripe_bios(sh2)\n                                -\u0026gt; lock(sh2)\n                                -\u0026gt; stripe_bio_overlaps(sh2) returns true\n\t\t\t\t   batch_head is NULL, so new bio overlap\n\t\t\t\t   exist bio on sh2 -\u0026gt; true\n                                -\u0026gt; set_bit(R5_Overlap, sh2-\u0026gt;dev[i].flags)\n                                -\u0026gt; unlock(sh2)\n                                -\u0026gt; wait_on_bit(sh2-\u0026gt;dev[i].flags)\n-\u0026gt; sh2-\u0026gt;dev[i].flags = sh1-\u0026gt;dev[i].flags \u0026amp; ~R5_Overlap\n\nNo wait_up_bit(), CPU2 could be wait_on_bit() forever...\n\nFix by :\n- Expand the protect zone.\n- Use batch_head\u0026apos;s device flag\u0026apos;s snaphot when no held head_sh-\u0026gt;stripe_lock.\n- Move sh/head_sh-\u0026gt;batch_head = NULL to the end of protected zone , and ,\n  any concurrent add_all_stripe_bios() grabs sh-\u0026gt;stripe_lock now either:\n\t- see batch_head != null, and , is rejected by stripe_bio_overlaps()\n\t  under the lock (no R5_Overlap wait ) , or ,\n\t- sees batch_head == NULL, only after dev[i].flags has already been\n\t  set and the prior R5_Overlap waiters worken.\n\nKCSAN report:\n================================================\n  BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request\n\n  write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:\n    raid5_make_request+0xea0/0x2930\n    md_handle_request+0x4a2/0xa40\n    md_submit_bio+0x109/0x1a0\n    __submit_bio+0x2ec/0x390\n    submit_bio_noacct_nocheck+0x457/0x710\n    submit_bio_noacct+0x2a7/0xc20\n    submit_bio+0x56/0x250\n    blkdev_direct_IO+0x54c/0xda0\n    blkdev_write_iter+0x38f/0x570\n    aio_write+0x22b/0x490\n    io_submit_one+0xa51/0xf70\n    __x64_sys_io_submit+0xf7/0x220\n    x64_sys_call+0x1907/0x1c60\n    do_syscall_64+0x130/0x570\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n  read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:\n    break_stripe_batch_list+0x249/0x480\n    handle_stripe_clean_event+0x720/0x9b0\n    handle_stripe+0x32fb/0x4500\n    handle_active_stripes.isra.0+0x6e0/0xa50\n    raid5d+0x7e0/0xba0\n    md_thread+0x15a/0x2d0\n    kthread+0x1e3/0x220\n    ret_from_fork+0x37a/0x410\n    ret_from_fork_asm+0x1a/0x30\n\n  value changed: 0x0000000000000019 -\u0026gt; 0x0000000000000099 --\u0026gt; R5_Overlap(CVE-2026-72420)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts-\u0026gt;error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts-\u0026gt;error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts-\u0026gt;error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts-\u0026gt;error.(CVE-2026-72423)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Proper rollback if the ioremap fails\n\nbnxt_qplib_alloc_dpi returns success even if ioremap fails.\nAdd the proper rollback when the ioremap fails and return\n-ENOMEM status.(CVE-2026-72496)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: clear sock_ops cb flags before force-closing a child socket\n\nA child socket inherits the listener\u0026apos;s bpf_sock_ops_cb_flags via\nsk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() /\ntcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where\ninet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs\nwithout it.\n\nIf BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -\u0026gt; tcp_set_state()\ncalls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():\n\n  WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550\n  RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   tcp_done+0xba/0x250 net/ipv4/tcp.c:5095\n   tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787\n   tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926\n   tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164\n   \u0026lt;/IRQ\u0026gt;\n\nThe child is freed before it is ever established, so it should run no\nsock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(),\nthe common point for the IPv4, IPv6 and chtls forced-close paths and for the\nMPTCP -\u0026gt;syn_recv_sock() failure path (dispose_child), which reaches tcp_done()\non a child that was never established too.(CVE-2026-74268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don\u0026apos;t dump dying fib_info in fib_leaf_notify().\n\nsyzbot reported use-after-free in nsim_fib4_prepare_event(). [0]\n\nThe problem is that the following functions call fib_info_hold() /\nrefcount_inc() while dumping fib_info under RCU, which is unsafe.\n\n  * mlxsw_sp_router_fib4_event()\n  * rocker_router_fib_event()\n  * nsim_fib4_prepare_event()\n\nrefcount_inc_not_zero() must be used, but it would be too late\nthere.\n\nLet\u0026apos;s guarantee the lifetime of fib_info in fib_leaf_notify().\n\nNote that IPv6 does not need the corresponding change since\nfib6_table_dump() holds fib6_table.tb6_lock.\n\n[0]:\nrefcount_t: addition on 0; use-after-free.\nWARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420\nModules linked in:\nCPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25\nCode: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a \u0026lt;67\u0026gt; 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f\nRSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293\nRAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0\nRBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000\nR13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000\nFS:  0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __refcount_add include/linux/refcount.h:-1 [inline]\n __refcount_inc include/linux/refcount.h:366 [inline]\n refcount_inc include/linux/refcount.h:383 [inline]\n fib_info_hold include/net/ip_fib.h:629 [inline]\n nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline]\n nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline]\n nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043\n call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25\n call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline]\n fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline]\n fib_table_notify net/ipv4/fib_trie.c:2194 [inline]\n fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217\n fib_net_dump net/core/fib_notifier.c:70 [inline]\n register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108\n nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596\n nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline]\n nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058\n devlink_reload+0x501/0x8d0 net/devlink/dev.c:475\n devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558\n ops_pre_exit_list net/core/net_namespace.c:161 [inline]\n ops_undo_list+0x187/0x940 net/core/net_namespace.c:234\n cleanup_net+0x56e/0x800 net/core/net_namespace.c:702\n process_one_work kernel/workqueue.c:3314 [inline]\n process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397\n worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;(CVE-2026-74289)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix UAF in hci_unregister_dev()\n\nhci_unregister_dev() does not disable cmd_timer and ncmd_timer\nbefore the hci_dev structure is freed. If a timeout fires\nduring device teardown, the callback dereferences freed memory\n(including the hdev-\u0026gt;reset function pointer), leading to a\nuse-after-free.\n\nAdd disable_delayed_work_sync() calls alongside the existing\ndisable_work_sync() calls to ensure both timers are fully\nquiesced before teardown proceeds.(CVE-2026-74302)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: do not configure xps for XDP queues\n\nnetif_set_xps_queue() should not be called for an XDP Tx queue, since such\nqueues are not netdev-exposed. On systems with number of CPUs \u0026gt;=64, on E610\nadapter, netdev is configured with maximum number queue pairs being 63\n(due to MSI-X assignment), but configuring XDP results in 64 XDP queues.\n\nSo, during XDP program load, when netif_set_xps_queue() is called for the\nlast XDP queue, we get a WARNING with a call trace and KASAN report\nafterwards (if enabled).\n\n[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668\n[...]\n[ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40\n[ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff \u0026lt;0f\u0026gt; 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84\n[ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246\n[ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000\n[ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488\n[ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000\n[ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8\n[ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8\n[ 2012.700065] FS:  00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000\n[ 2012.700069] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0\n[ 2012.700077] PKRU: 55555554\n[ 2012.700080] Call Trace:\n[ 2012.700084]  \u0026lt;TASK\u0026gt;\n[ 2012.700087]  ? ktime_get+0x61/0x150\n[ 2012.700097]  ? usleep_range_state+0x133/0x1b0\n[ 2012.700108]  ? __pfx_usleep_range_state+0x10/0x10\n[ 2012.700114]  netif_set_xps_queue+0x31/0x50\n[ 2012.700119]  ixgbe_configure_tx_ring+0x472/0x920 [ixgbe]\n[...]\n[ 2012.700486]  ixgbe_xdp+0x38f/0x750 [ixgbe]\n\n[...]\n\n[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40\n[ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668\n\nSkip XPS configuration for XDP Tx queues.(CVE-2026-74317)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq-\u0026gt;avail_idx. Instead, it returns whether all entries have been\nconsumed, which is usually the same. But not always - in\ndrivers/vhost/net.c and when mergeable buffers have been enabled, the\ndriver checks whether the combined entries are big enough to store an\nincoming packet. If not, the driver re-enables notifications with\navailable entries still in the ring. The incorrect return value from\nvhost_get_avail_idx propagates through vhost_enable_notify and causes\nthe host to livelock if the guest is not making progress, as vhost will\nimmediately disable notifications and retry using the available entries.\n\nThis goes back to commit d3bb267bbdcb (\u0026quot;vhost: cache avail index in\nvhost_enable_notify()\u0026quot;) which changed vhost_enable_notify() to compare\nthe freshly read avail index against vq-\u0026gt;last_avail_idx instead of the\npreviously cached vq-\u0026gt;avail_idx. Commit 7ad472397667 (\u0026quot;vhost: move\nsmp_rmb() into vhost_get_avail_idx()\u0026quot;) then carried over the same\ncomparison when refactoring vhost_enable_notify() to call the unified\nvhost_get_avail_idx().\n\nThe obvious fix is to make vhost_get_avail_idx do what the comment\nsays it does and report whether new entries have been added.(CVE-2026-74356)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: fix deadlock in read error recovery path\n\nraid1d and raid10d may resubmit a split md cloned bio while handling\na read error. In this case, resubmitting the bio can lead to a deadlock\nif the array is suspended before md_handle_request() acquires an\nactive_io reference via percpu_ref_tryget_live().\n\nSince the cloned bio already holds an active_io reference,\ntrying to acquire another reference via percpu_ref_tryget_live()\ncan lead to a deadlock while the array is suspended.\n\nFix this by using percpu_ref_get() for md cloned bios.(CVE-2026-74375)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix page fragment cache leak in error path\n\nIn nvmet_tcp_alloc_queue(), when a connection is closed during the\nallocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),\nthe error handling jumps to out_destroy_sq and then to out_ida_remove\nwithout draining the page fragment cache.\n\nAlthough nvmet_tcp_free_cmd() is called in some error paths to release\nindividual page fragments, the underlying page cache reference held by\nqueue-\u0026gt;pf_cache is never released. The first allocation using pf_cache\nis the call to nvmet_tcp_alloc_cmd() for queue-\u0026gt;connect, which happens\nafter ida_alloc() returns successfully. This results in a page leak each\ntime a connection fails during allocation, which could lead to memory\nexhaustion over time if connections are repeatedly opened and closed.\n\nFix this by calling page_frag_cache_drain() before freeing the queue\nstructure in the out_ida_remove label.(CVE-2026-74386)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb-\u0026gt;data.\n\nHowever, in vxlan_xmit(), skb-\u0026gt;data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb-\u0026gt;data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)-\u0026gt;daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer.(CVE-2026-74473)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n-\u0026gt;ha can be updated asynchronously by the\nneighbour subsystem, protected by n-\u0026gt;ha_lock seqlock. Reading n-\u0026gt;ha without\nholding the seqlock loop can lead to torn reads or reading a partially updated\nMAC address.\n\nUse neigh_ha_snapshot() in route_shortcircuit() to safely copy n-\u0026gt;ha under\nread_seqbegin()/read_seqretry() lock protection before using it.\n\nNote that arp_reduce() and neigh_reduce() seem to have the same issue\nleft for future patches.(CVE-2026-74475)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.(CVE-2026-74476)\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend. During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete their virtqueues via vdev-\u0026gt;config-\u0026gt;del_vqs(). However, page reporting work (page_reporting_process) was scheduled on the global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM freezer skips it, leaving page_reporting_process active during suspend. If pages are freed into the buddy allocator while suspending, page reporting triggers virtballoon_free_page_report() on deleted virtqueues, resulting in a Use-After-Free / General Protection Fault.(CVE-2026-74481)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter.\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters \u0026apos;P\u0026apos;, \u0026apos;O\u0026apos;, \u0026apos;C\u0026apos; and \u0026apos;F\u0026apos; and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character.(CVE-2026-74485)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode\u0026apos;s i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\u0026quot;binfmt_misc: restore write access before\nclosing files opened by open_exec()\u0026quot;) fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file.(CVE-2026-74487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\\n\\nsnd_usbmidi_akai_output() computes its fill-loop bound\\n\\n\\tbuf_end = ep-\u0026gt;max_transfer - MAX_AKAI_SYSEX_LEN - 1;\\n\\nas a signed int, so a small device-advertised bulk-OUT max_transfer\\nmakes buf_end negative.  The loop guard then compares the u32\\nurb-\u0026gt;transfer_buffer_length against that negative int: the usual\\narithmetic conversion turns buf_end into a large unsigned value, so the\\nguard stays true and each iteration keeps appending SysEx framing and\\npayload bytes past the end of the URB transfer buffer, which is only\\nmax_transfer bytes long.\\n\\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\\ntrigger an attacker-length- and content-controlled heap out-of-bounds\\nwrite when a process writes to the created /dev/snd/midiC*D* node.\\n\\nReturn early when there is no room for even one SysEx, so the loop is\\nnever entered with a bound that would wrap.  The loop is the last\\nstatement of the function, so bailing out is equivalent to it not\\nrunning.\\n\\nDiscovered by XBOW, triaged by Baul Lee \u0026amp;lt;baul.lee@xbow.com\u0026amp;gt;(CVE-2026-74499)\n\nIn the Linux kernel, a use-after-free (UAF) vulnerability exists in the Bluetooth HCI sync module. hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev-\u0026gt;lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some cases, retain the pointer while waiting for a controller response. An advertising termination event can interleave, causing a use-after-free of the adv_info pointer, leading to a slab-use-after-free error as detected by KASAN. An attacker could potentially exploit this vulnerability to cause a system crash or potential information disclosure.(CVE-2026-74509)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix memory accounting for pinned/unpinned pages\n\nThe account_mem() and unaccount_mem() functions call get_uid() which\nincrements the reference count of struct user_struct on every invocation.\nBut we don\u0026apos;t decrement the count by calling free_uid(). It also\naccounted/unaccounted the pages against the current-\u0026gt;mm. But its possible\nthe unaccount_mem() can be called from a different process context than the\none that originally pinned the pages.\n\nLet\u0026apos;s fix this by storing the pinning process user_struct and mm_struct\nwhen accounting for pinned pages, and subsequently free these resources\nwhen the pages are unpinned.\n\n[(CVE-2026-74514)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0026apos;s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0026apos;s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD.(CVE-2026-74520)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix leaking sk after socket release\n\niso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk-\u0026gt;sk_socket ||\nsock_flag(sk, SOCK_DEAD) for early return, but this is always true since\nsock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket\nalways leaks, iso_sock_destruct is never called.\n\nThe socket reference also leaks when __iso_sock_close() does not set\nSOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after\nzapping.\n\nFix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for\nsomething else, and lock_sock to ensure iso_sock_kill() puts sk only\nafter socket release only once. Release and iso_conn_del may run\nconcurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up\nafter zapping.\n\nRemove call to iso_sock_kill() from iso_sock_close(), as it\u0026apos;s generally\nno-op there.(CVE-2026-74536)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()\n\nsyzbot reported a memory leak [1] in the UDP tunnel NIC offload code.\n\nWhen device registration fails (e.g. in register_netdevice()), netdev core\nunwinds by sending a single NETDEV_UNREGISTER notification. If work was queued\nduring NETDEV_REGISTER (utn-\u0026gt;work_pending is set), udp_tunnel_nic_unregister()\nreturns early:\n\n\tif (utn-\u0026gt;work_pending)\n\t\treturn;\n\nBecause failed registrations do not enter netdev_wait_allrefs_any(), no\nsubsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the\nstruct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked\npermanently.\n\nFix this by removing the early return. Instead, synchronously cancel any\npending work with cancel_delayed_work_sync() before freeing @utn.\n\nTo be able to call cancel_delayed_work_sync() while holding RTNL (the work also\nneeds RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL\nis contended, requeue the work with a 1 jiffy delay (via queue_delayed_work())\nto prevent high CPU contention while waiting for RTNL lock.\n\nThe utn-\u0026gt;work_pending bookkeeping is no longer needed and is removed, as\nthe workqueue core already tracks the pending/running state of the work.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff888127d5f840 (size 96):\n  comm \u0026quot;syz-executor\u0026quot;, pid 5806, jiffies 4294942188\n  backtrace (crc 99fdb6c8):\n    __kmalloc_noprof+0x3bf/0x550\n    udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]\n    udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]\n    udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931\n    notifier_call_chain+0x59/0x160 kernel/notifier.c:85\n    call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250\n    register_netdevice+0xc10/0xeb0 net/core/dev.c:11478(CVE-2026-74543)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: validate offshift to prevent shift-out-of-bounds\n\nu32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,\n0-255) into the kernel knode object without bounds validation. When a\npacket later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates\n`ntohs(offmask \u0026amp; *data) \u0026gt;\u0026gt; offshift` where the left operand is a 16-bit\nvalue promoted to a 32-bit int. Any offshift \u0026gt;= 32 is undefined behavior\nper C11 6.5.7p3, triggerable by an unprivileged user via user/network\nnamespaces.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43\nshift exponent 32 is too large for 32-bit type int\n\nFix this by rejecting offshift \u0026gt;= 16 during filter creation in\nu32_change().(CVE-2026-74544)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: make nft_object rhltable per table\n\nThe nft_object rhltable is global, this allows for accessing objects\nthat are being dismangled from lookup path by other existing netns.\nGiven the nft_obj_destroy() releases the object inmediately, this might\nlead to use-after-free of these objects that are being released.\nMake the existing rhltable per table to address this issue to deal with\nwith the nft_rcv_nl_event() path too.\n\nUpdate nft_obj_lookup() to take the table as non-const, otherwise,\ncompiler complains when passing the objname_ht to rhltable_lookup().(CVE-2026-74565)\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer. sctp_process_asconf_param() stores a newly added peer transport in asoc-\u0026gt;new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same chunk. The wildcard deletion preserves the transport on which the ASCONF arrived, but removes the newly added transport through sctp_assoc_del_nonprimary_peers(). The removal does not clear asoc-\u0026gt;new_transport, leaving it pointing to the removed transport. sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u0026gt;transport points to the removed transport without holding a transport reference. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads the freed transport\u0026apos;s state, leading to a use-after-free condition.(CVE-2026-74586)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: fix use-after-free of cached ASCONF chunk\\n\\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\\nASCONF-ACK completion path releases the chunk and clears the pointer.\\n\\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\\nclearing addip_last_asconf. During peer restart handling,\\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\\nsctp_asconf_queue_teardown() while the association remains alive and leaves\\nthe pointer dangling.\\n\\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\\ncausing a use-after-free and a second release.\\n\\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\\ntimer_delete(), which does not wait for a callback already running on\\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\\nthe purge and dereference NULL.\\n\\nClear addip_last_asconf after releasing the cached chunk, and make\\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\\nASCONF remains.(CVE-2026-74587)\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-\u0026gt;transport in step with the list it is queued on. __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0026apos;s transmitted list without updating chunk-\u0026gt;transport. The chunk then sits on a live transport\u0026apos;s list while chunk-\u0026gt;transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. A SACK that reneges on the TSN clears the flag, and the next SACK reaches inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer().(CVE-2026-74588)\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict. sk_psock_msg_verdict() takes a socket reference for psock-\u0026gt;sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir(). When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer, leading to a use-after-free. KASAN reported a slab-use-after-free error.(CVE-2026-74589)\n\nIn the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers. When an eventfs inode is freed, it sets ei-\u0026gt;is_freed and then uses its ei-\u0026gt;list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei-\u0026gt;list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there\u0026apos;s nothing stopping the iteration over that list to see the ei-\u0026gt;rcu instead of the ei-\u0026gt;list and it will read a corrupt target.(CVE-2026-74605)\n\nIn the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec(). eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running.(CVE-2026-74606)\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels(). cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface-\u0026gt;weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.(CVE-2026-74608)\n\nIn the Linux kernel, the following vulnerability has been resolved: tipc: read le-\u0026gt;link under the node lock in tipc_node_link_down(). tipc_node_link_down() caches the link pointer before taking n-\u0026gt;lock. The delete=true caller frees that very object under n-\u0026gt;lock, so the lock does not protect the cached pointer against it. An in-flight CPU that has read l therefore dereferences freed memory once another CPU frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.(CVE-2026-74609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0026apos;t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the \u0026quot;tls\u0026quot; ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.(CVE-2026-74610)\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry. tls_decrypt_sg() advances msg-\u0026gt;msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD.(CVE-2026-74611)\n\nIn the Linux kernel, the veth driver has an skb length accounting error after XDP frag adjustment. veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb-\u0026gt;data_len but leaves skb-\u0026gt;len containing the old fragment contribution. After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. Additionally, bpf_xdp_pull_data() can advance data_end while leaving frags present, and the old __skb_put(skb, off) triggers SKB_LINEAR_ASSERT().(CVE-2026-74612)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nvsock/virtio: read virtqueues under worker locks\\n\\nCommit bd50c5dc182b (\u0026quot;vsock/virtio: add support for device suspend/resume\u0026quot;) made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue\u0026apos;s running state while retaining a pointer to the deleted queue.\\n\\nRead each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.(CVE-2026-74614)\n\nIn the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down. vxlan_changelink() arms vxlan-\u0026gt;age_timer whenever the requested ageing interval differs from the configured one, but there is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device. When free_netdev() releases the allocation, the timer lives in freed memory while still queued on a timer_base, causing a use-after-free condition that can lead to system crash or code execution.(CVE-2026-74615)\n\nIn the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom. xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone\u0026apos;s required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.(CVE-2026-74616)\n\nIn the Linux kernel, an input validation vulnerability exists in the net/sched subsystem. The act_gact and act_police modules lack range checking on the fallback control action. The tcf_action_check_ctrlact() function performs range checking on the primary control action, but act_gact and act_police each carry a second, independent control action supplied by user space (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) that never reaches that helper. User space can set TC_ACT_CONSUMED (TC_ACT_VALUE_MAX + 1), which tells callers the action took ownership of the skb, resulting in memory leaks of sk_buff and its data buffer - one leaked sk_buff per packet traversing the filter.(CVE-2026-74620)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: atlantic: free stranded TX buffers on ring deinit\\n\\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer moves once aq_vec_stop() has stopped the hardware and NAPI. Completed descriptors beyond the budget and everything still posted in [hw_head, sw_tail) keep their skb or xdp_frame when the interface goes down: aq_vec_ring_free() then frees the buffer ring and the references are lost for good.\\n\\nToday this is a silent memory leak on every interface down under TX/XDP_TX load. With the conversion of the RX path to page_pool posted for net-next it becomes much more visible: XDP_TX frames carry fragment references on the RX ring\u0026apos;s page_pool, so a single stranded frame keeps the pool\u0026apos;s inflight count above zero forever. page_pool_destroy() then never completes, the pool is leaked together with its pages, and \\\u0026quot;page_pool_release_retry() stalled pool shutdown\\\u0026quot; is warned every 60 seconds from that point on, on every ifdown, XDP detach or ring resize under XDP_TX load.(CVE-2026-74623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct-\u0026gt;lock is still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct-\u0026gt;lock, so logging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while ct-\u0026gt;lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached while ct-\u0026gt;lock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct-\u0026gt;lock are caught outside TCP and SCTP as well.(CVE-2026-74624)\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and event_define_fields. The following sequence may lead to a race between event_define_fields() and update_event_fields(): CPU0 (loads module A) and CPU1 (loads module B) executing concurrently, where access to class-\u0026gt;fields is not protected by event_mutex in trace_event_update_all(), leading to a kernel panic. Fix by taking event_mutex in trace_event_update_all() before trace_event_sem.(CVE-2026-74636)\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach. perf_group_detach() handles leader and sibling detach differently. When a sibling is detached, it is removed from the leader\u0026apos;s sibling_list, but its group_leader pointer is left pointing at the old leader. This is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. A PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale group_leader pointer and dereferences the freed leader\u0026apos;s context, leading to a use-after-free condition.(CVE-2026-74637)\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu(). fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock. The following interleaving can therefore occur: CPU 0 (fib_nhc_update_mtu) loads fnhe while CPU 1 (update_or_create_fnhe) holds fnhe_lock, calls fnhe_remove_oldest() to unlink fnhe, and kfree_rcu(fnhe, rcu). CPU 0 then accesses fnhe after grace period, causing a use-after-free. KASAN reported: BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410.(CVE-2026-74656)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving causes a use-after-free condition where CPU 1 dereferences per-net state after CPU 0 has freed it.(CVE-2026-74660)\n\nIn the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer. inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.(CVE-2026-74662)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\npacket: synchronize pressure clearing with ring reconfiguration\\n\\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po-\u0026gt;prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage.(CVE-2026-74666)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb-\u0026gt;mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb-\u0026gt;head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c (\u0026quot;macsec: do not read an unset MAC header in macsec_encrypt()\u0026quot;).\n\npacket_parse_headers() runs only on the transmit path, where skb-\u0026gt;data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.(CVE-2026-74667)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in TX_RING send path\n\ntpacket_snd() reads dev-\u0026gt;hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.\n\nSnapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and header_ops-\u0026gt;create is not addressed here.(CVE-2026-74668)\n\nIn the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors. ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)-\u0026gt;opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.(CVE-2026-74669)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: stop estimator after disabled calc phase\n\nIPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-\u0026gt;enable during that phase, ip_vs_est_calc_phase() can return without installing positive limits.\n\nThe kthread can then continue into its main loop and drain est_temp_list with zero chain_max, tick_max and est_max_count values. Each enqueue consumes one available tick row, but est_count never reaches the zero est_max_count value. After all rows are consumed, the row lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays, causing a buffer overflow.\n\nExit kthread 0 after the calculation phase if the kthread is stopping or IPVS has been disabled. That keeps temporary estimators from being drained after the limits failed to initialize.\n\nEstimator kthreads can now self-exit before teardown or reload stops kd-\u0026gt;task. Keep an extra task reference after creation and release it with kthread_stop_put(), so kd-\u0026gt;task remains valid until the stop paths consume that reference.(CVE-2026-74670)\n\nIn the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values(). In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized. When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information. Similar issues exist in __evdev_queue_syn_dropped and __pass_event. Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary.(CVE-2026-74673)\n\nIn the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks. The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask(). While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads. Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds, preventing any speculative memory access to client evmasks array.(CVE-2026-74683)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tap: set skb-\u0026gt;dev before parsing virtio net header in tap_get_user_xdp()\\n\\nThe commit 4f61f133f354 (\u0026quot;net: tap: NULL pointer derefence in dev_parse_header_protocol when skb-\u0026gt;dev is null\u0026quot;) fixed a crash in tap_get_user() by assigning skb-\u0026gt;dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb-\u0026gt;dev. Without the assignment, a NULL pointer dereference can occur.\\n\\nHowever, tap_get_user_xdp() still parses the virtio-net header before assigning skb-\u0026gt;dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb-\u0026gt;dev is still NULL, resulting in a crash.\\n\\nFix this by looking up the tap device and assigning skb-\u0026gt;dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().(CVE-2026-74684)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: clear control chunk transport if it is being removed\\n\\nsctp_make_heartbeat_ack() caches the destination transport in chunk-\u0026gt;transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.\\n\\nIf the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.\\n\\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.\\n\\nFix this by also clearing chunk-\u0026gt;transport for queued control chunks in control_chunk_list when removing the transport.(CVE-2026-74688)\n\nIn the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration. A listener\u0026apos;s TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener\u0026apos;s qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue-\u0026gt;young and queue-\u0026gt;qlen.(CVE-2026-74696)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u0026gt;head,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free.(CVE-2026-74705)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value.  __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts-\u0026gt;netns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n  CPU 0                                  CPU 1\n  read opts-\u0026gt;netns_id (-1)\n  skip get_net_ns_by_id()\n                                         write opts-\u0026gt;netns_id (id)\n  read opts-\u0026gt;netns_id (id)\n  put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference.  Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n  RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n  Call Trace:\n   __sys_bpf+0x1662/0x50c0\n   __x64_sys_bpf+0x73/0xb0\n   do_syscall_64+0xf9/0x540\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it.  The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation.  The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation.(CVE-2026-74715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller\u0026apos;s temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent.(CVE-2026-74720)\n\nIn the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp. Sashiko warns that a local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area. Fix it by providing ciph argument just like it is done for IPv6 and use ciph-\u0026gt;len as offset to the embedded transport header. Modify some IPv4 header checks by reading the ihl field only once.(CVE-2026-74724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\\n\\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -\u0026gt; __bond_release_one() -\u0026gt; bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave\u0026apos;s promiscuity counter and pins it in IFF_PROMISC.\\n\\n  Oops: general protection fault, probably for non-canonical address ...\\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\n  Workqueue: b42 bond_alb_monitor\\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\\n   process_one_work (kernel/workqueue.c:3322)\\n   worker_thread (kernel/workqueue.c:3486)\\n   kthread (kernel/kthread.c:436)\\n   ret_from_fork (arch/x86/kernel/process.c:158)\\n  Kernel panic - not syncing: Fatal exception\\n\\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.(CVE-2026-74726)\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Pin the \u0026apos;struct nfs_server\u0026apos; during a FREE_STATEID call. Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the \u0026apos;struct nfs_server\u0026apos; object for the duration of the FREE_STATEID so it doesn\u0026apos;t get cleaned up from underneath us while operations are still in flight.(CVE-2026-74730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nfirewire: ohci: fix NULL pointer dereference in ar_context_release\\n\\nDuring the error handling path of the driver\u0026apos;s probe function, a NULL pointer dereference can occur in ar_context_release().\\n\\nWhen pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx-\u0026gt;ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()).\\n\\nar_context_release() immediately dereferences ctx-\u0026gt;ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash.(CVE-2026-74734)\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class(). u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses \u0026amp;n-\u0026gt;res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res-\u0026gt;classid in tc_cls_bind_class().(CVE-2026-74739)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n   in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.(CVE-2026-74744)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nipvs: revalidate ihl to prevent out-of-bounds access\\n\\nWhile the outer IP header is already pulled into the skb head,\\nwe must be careful and revalidate the embedded headers after\\nreading them from the skb frags to prevent out-of-bounds\\naccess.\\n\\nOne such place reported by Sashiko is ip_vs_nat_icmp() where\\nlocal process can change the ihl field and after\\nskb_ensure_writable() we can see larger value which is a\\nproblem for the ip_send_check(cih) calls.\\n\\nAdd check to drop the packet if the ihl field is changed.(CVE-2026-74747)\n\nIn the Linux kernel, the netfilter/ipset component has a refcount race condition vulnerability. __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set-\u0026gt;ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets\u0026apos; ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set-\u0026gt;ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -\u0026gt; ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. This vulnerability can cause kernel panic.(CVE-2026-74748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Reject exited events as group leaders\n\nperf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event\u0026apos;s file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events.\n\nA new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event.\n\nReject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment.\n\n[peterz: make the earlier test fully consistent](CVE-2026-74753)\n\nIn the Linux kernel, a deadlock vulnerability has been found in the ceph filesystem. A reader can hang forever in __ceph_get_caps() when the client no longer holds FILE_RD, but local cap state still says that the capability is already wanted (via mds_wanted). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke FILE_RD from the reader; the next read then has to reacquire FILE_RD. If the cap update that should request FILE_RD never reaches the MDS after cap-\u0026gt;mds_wanted was raised, the reader is left holding only non-file caps while local mds_wanted still includes the file read caps, causing the reader to wait indefinitely.(CVE-2026-80527)\n\nIn the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-\u0026gt;journal_info. handle_reply() stores a ceph_mds_request pointer in current-\u0026gt;journal_info while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in current-\u0026gt;journal_info as a journal handle and dereferences the request\u0026apos;s r_tid as h_transaction, causing a kernel crash.(CVE-2026-80528)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nxfs: don\u0026apos;t swallow dquot recovery verification errors\\n\\nxlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.(CVE-2026-80529)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item\u0026apos;s dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item\u0026apos;s bitmap into the buffer read for that item:\n\n\tmemcpy(xfs_buf_offset(bp, (uint)bit \u0026lt;\u0026lt; XFS_BLF_SHIFT),\n\t\titem-\u0026gt;ri_buf[i].iov_base,\n\t\tnbits \u0026lt;\u0026lt; XFS_BLF_SHIFT);\n\nThe destination offset (bit/nbits, from the logged dirty bitmap) and the\nbuffer size (from the logged blf_len) are both attacker-controlled and\notherwise unrelated, yet the only thing bounding the copy is an ASSERT(),\nwhich compiles away on production kernels. A crafted image logging a\nsmall blf_len together with a bitmap bit past the end of that buffer\ndrives the memcpy() past the buffer\u0026apos;s allocation, corrupting adjacent\nkernel heap during mount-time log recovery. This is reachable by anyone\nwho can get a crafted image mounted -- the malicious-filesystem threat\nmodel XFS already guards against elsewhere.\n\nTurn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery\nof the buffer with -EFSCORRUPTED, consistent with the validate-and-fail\nidiom already used in xlog_recover_do_inode_buffer() and\nxfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes\nSTATIC int and its three callers propagate the error.\n\nFound and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted\nimage trips a slab-out-of-bounds write before this change and fails\nrecovery cleanly with -EFSCORRUPTED after it.(CVE-2026-80536)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Move cp cleanup out of not operational\n\nThe fsm_notoper() routine is called when the device has been\nlost, and is (by definition) no longer operational. Since this\ncan happen asynchronously from the normal behavior of the\ndriver, the cleanup may happen when holding other locks\nin the calling sequence (notably, the cio subchannel lock).\n\nPush the cleanup of the private-\u0026gt;cp resources to a workqueue,\nwhere it can be done out from under that lock sequence and\na future patch can safely manage the locking requirements.(CVE-2026-80549)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Ensure first IDAW remains constant\n\nThe first IDAW in a list does not need to be on a 2K/4K boundary\nlike all others, and so is read separately to accurately calculate\nthe size of the buffer needed to read the full IDAL.\n\nVerify that the address found in the first IDAW is unchanged between\nreads, to ensure a consistent set of IDAWs being worked with.(CVE-2026-80551)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix OOB read in decode_watchers() via missing bounds check\n\nceph_start_decoding() validates that struct_len bytes remain in the\nbuffer after the encoding header, but accepts struct_len=0 as valid:\nceph_decode_need(p, end, 0, bad) always passes. When a malicious or\ncompromised OSD sends an obj_list_watch_response_t reply with\nstruct_len=0, ceph_start_decoding() returns success with p == end,\nleaving zero bytes guaranteed for subsequent reads.\n\nThe immediately following ceph_decode_32(p) in decode_watchers() has\nno preceding bounds check. With p == end this is a 4-byte read past\nthe validated buffer boundary. The garbage value is then passed\ndirectly to kzalloc_objs() as the watcher count.\n\nThe sibling function decode_watcher() already uses the safe variants\n(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)\nafter its own ceph_start_decoding() call. decode_watchers() is the\nonly site that uses the bare variant, confirming an oversight.\n\nFix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end,\n*num_watchers, bad), consistent with the established pattern.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment (e.g. cloud) can trigger this against any kernel client\nthat calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges\nbeyond OSD session establishment.\n\n[ idryomov: trim changelog ](CVE-2026-80557)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Avoid using invalid osd indices from primary_temp\n\nA corrupted osdmap received from a Ceph monitor or OSD may contain osd\nindices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts\nthat don\u0026apos;t exist, i.e., that are greater than max_osd or smaller than\nCEPH_HOMELESS_OSD (-1). These indices are used to create the up and\nacting set in ceph_pg_to_up_acting_osds(), called from calc_target().\nWhile most of these osd indices are checked, the one from primary_temp\nis not. Subsequently, this may lead to calc_target() returning this\n(potentially invalid) index as target osd for a (linger) request.\nBecause the osd_state, osd_weight, and osd_addr arrays only contain\nmax_osd entries (with indices 0 to max_osd -1), this leads to\nout-of-bounds accesses when trying to read values from these arrays.\n\nThis patch fixes the issue by adding a check to get_temp_osds(), so that\nonly valid osd indices from primary_temp are used, and it falls back to\nusing the primary from pg_temp or the up set if it is invalid.\n\n[ idryomov: changelog ](CVE-2026-80558)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: signal: do not restore privileged SR bits on sigreturn\n\nrestore_sigcontext() copies the whole supervision register (SR) from the\nsignal frame and only clears SPR_SR_SM before the value is reloaded into\nthe hardware SR (through ESR and l.rfe) on the return to user space.  All\nother SR bits are left under user control.\n\nAn unprivileged task can thus return from a signal handler through a\ncrafted sigframe that clears SPR_SR_DME.  With the data MMU disabled the\nCPU performs no translation or protection on data accesses, so the task\ngains read and write access to arbitrary physical memory, a local\nprivilege escalation.  SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH\nand the cache-enable bits are exposed the same way.  The ptrace GPR regset\nalready refuses any change to SR for exactly this reason.\n\nRestore only the arithmetic flag bits (F, CY, OV) from the signal frame\nand take every privileged control bit from the SR the kernel saved on\nsignal entry.\n\nVerified with qemu-system-or1k -M or1k-sim: before this change an\nunprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to\nphysical address 0x03000000 (beyond the kernel\u0026apos;s mem=32M); afterwards the\nsame PoC receives SIGSEGV and physical memory is unchanged.(CVE-2026-80560)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: avoid combining some incoming suboptions\\n\\nSome MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn\u0026apos;t expect some combinations to be present. That\u0026apos;s specially true for suboptions that would be present twice, but with different attributes.\\n\\nThe new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux.(CVE-2026-80587)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: stop the timeout timer when releasing a never added disk\n\ndisk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q-\u0026gt;timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket.\n\nCommit 6f8191fdf41d (\u0026quot;block: simplify disk shutdown\u0026quot;) dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it.\n\nnvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns-\u0026gt;queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed, leading to a use-after-free condition.(CVE-2026-80589)\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg. Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove the WARN_ON_ONCE().(CVE-2026-80607)\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Mark LPI enter functions as __cpuidle. When function tracing or Kprobes is enabled, entering an ACPI Low Power Idle (LPI) state triggers the following RCU splat: RCU not on for: acpi_idle_lpi_enter+0x4/0xd8. The acpi_idle_lpi_enter() function is invoked within the cpuidle path after RCU has already been disabled for the current local CPU. Consequently, ftrace\u0026apos;s function_trace_call() expects RCU to be actively watching before recording trace data, emitting a warning if it is not. Fix this by annotating acpi_idle_lpi_enter(), the generic __weak stub, and the RISC-V implementation of acpi_processor_ffh_lpi_enter() with __cpuidle. This moves these functions into the \u0026apos;.cpuidle.text\u0026apos; section, implicitly disabling ftrace instrumentation (notrace) along this sensitive path and preventing trace-induced RCU warnings during idle entry.(CVE-2026-80611)\n\nIn the Linux kernel, the netfilter synproxy module has an unaligned memory access issue in timestamp adjustment. Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory access or even a crash on strict alignment architectures. This follows the implementation of timestamp parsing in the networking stack at tcp_parse_options() and synproxy_parse_options().(CVE-2026-80637)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix warning in poll cq direct mode\\n\\nCQs allocated by ib_alloc_cq() always have a comp_handler. Though\\nin direct mode this handler is never expected to be called, it\\nis still called when the driver is reset, triggering the following\\nWARN_ONCE():\\n\\nCall trace:\\nib_cq_completion_direct+0x38/0x60\\nhns_roce_cq_completion+0x54/0x90 (hns_roce_hw_v2]\\nhns_roce_handle_device_err+Ox1c8/0x340 [hns_roce_hw_v2]\\nhns_roce_hw_v2_uninit_instance.constprop.0+0x34/0x70 [hns_roce_hw_v2]\\nhns_roce_hw_v2_reset_notify+0xc4/0xe0 [hns_roce_hw_v2]\\nhclge_notify_roce_client+0x60/0xbc [hclge]\\nhclge_reset_rebuild+0x48/0x34c [hclge]\\nhclge_reset_subtask+0xcc/0xec [hclge]\\nhclge_reset_service_task+0x80/0x160 [hclge]\\nhclge_service_task+0x50/0x80 (hclge]\\nprocess_one_work+0x1cc/0x4d0\\nworker_thread+0x154/0x414\\nkthread+0x104/0x144\\nret_from_fork+0x10/0x18(CVE-2026-80647)\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn. After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn-\u0026gt;hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.(CVE-2026-80721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\u0026quot;net: add support for ipv4 big tcp\u0026quot;)\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p-\u0026gt;mac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p-\u0026gt;mac_header \u0026lt; 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb-\u0026gt;head,\n   causing an out-of-bounds write and wrapping skb-\u0026gt;mac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p-\u0026gt;protocol != ETH_P_IPV6 was true.\n3. It checked p-\u0026gt;encapsulation instead of NAPI_GRO_CB(skb)-\u0026gt;encap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)-\u0026gt;proto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)-\u0026gt;encap_mark \u0026amp;\u0026amp; !p-\u0026gt;encapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p-\u0026gt;mac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at \u0026lt;= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\u0026quot;net/ipv6: Drop HBH for BIG TCP on RX\nside\u0026quot;), making this fix relevant only for older stable branches like\n6.18.y.(CVE-2026-80725)","status":"published","published":"2026-09-14T16:33:35Z","modified":"2026-09-13T16:45:52.354731727Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3708","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently.(CVE-2026-31668)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\n\nThe current implementation incorrectly handles memory regions (MRs) with\npage sizes different from the system PAGE_SIZE. The core issue is that\nrxe_set_page() is called with mr-\u0026gt;page_size step increments, but the\npage_list stores individual struct page pointers, each representing\nPAGE_SIZE of memory.\n\nib_sg_to_page() has ensured that when i\u0026gt;=1 either\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\nor\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u0026gt;page_size aligned.\n\nThis leads to incorrect iova-to-va conversion in scenarios:\n\n1) page_size \u0026lt; PAGE_SIZE (e.g., MR: 4K, system: 64K):\n   ibmr-\u0026gt;iova = 0x181800\n   sg[0]: dma_addr=0x181800, len=0x800\n   sg[1]: dma_addr=0x173000, len=0x1000\n\n   Access iova = 0x181800 + 0x810 = 0x182010\n   Expected VA: 0x173010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x182010 \u0026gt;\u0026gt; 12) - (0x181800 \u0026gt;\u0026gt; 12) = 1\n     - page_offset = 0x182010 \u0026amp; 0xFFF = 0x10\n     - xarray[1] stores system page base 0x170000\n     - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\n\n2) page_size \u0026gt; PAGE_SIZE (e.g., MR: 64K, system: 4K):\n   ibmr-\u0026gt;iova = 0x18f800\n   sg[0]: dma_addr=0x18f800, len=0x800\n   sg[1]: dma_addr=0x170000, len=0x1000\n\n   Access iova = 0x18f800 + 0x810 = 0x190010\n   Expected VA: 0x170010 (second SG, offset 0x10)\n   Before fix:\n     - index = (0x190010 \u0026gt;\u0026gt; 16) - (0x18f800 \u0026gt;\u0026gt; 16) = 1\n     - page_offset = 0x190010 \u0026amp; 0xFFFF = 0x10\n     - xarray[1] stores system page for dma_addr 0x170000\n     - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\n\nYi Zhang reported a kernel panic[1] years ago related to this defect.\n\nSolution:\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\n   indexing (all MR page indices are contiguous)\n2. Each rxe_mr_page stores both struct page* and offset within the\n   system page\n3. Handle MR page_size != PAGE_SIZE relationships:\n   - page_size \u0026gt; PAGE_SIZE: Split MR pages into multiple system pages\n   - page_size \u0026lt;= PAGE_SIZE: Store offset within system page\n4. Add boundary checks and compatibility validation\n\nThis ensures correct iova-to-va conversion regardless of MR page size\nand system PAGE_SIZE relationship, while improving performance through\narray-based sequential access.\n\nTests on 4K and 64K PAGE_SIZE hosts:\n- rdma-core/pytests\n  $ ./build/bin/run_tests.py  --dev eth0_rxe\n- blktest:\n  $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\n\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/(CVE-2026-46325)\n\nIn the Linux kernel, compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task\u0026apos;s pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task\u0026apos;s register state on error.(CVE-2026-64082)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq-\u0026gt;hr_sk-\u0026gt;sk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock-\u0026gt;file: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock-\u0026gt;file during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path.  Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use.  When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch.(CVE-2026-64523)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n   check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n   internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n   OSD sends struct_len=0, ceph_start_decoding() returns success with\n   p == end. The immediately following bare ceph_decode_32(p) then reads\n   4 bytes past the validated buffer boundary. The garbage value is\n   passed directly to kzalloc_objs() as the locker count.\n\n   The sibling function decode_watchers() in osd_client.c already uses\n   ceph_decode_32_safe() after its own ceph_start_decoding() call.\n   decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n   bounds check. If an OSD crafts num_lockers such that the loop\n   advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n   one byte past the validated buffer boundary. The result is passed\n   directly into *type, which is used as a lock type discriminator by\n   callers, giving an OSD-controlled one-byte OOB read with direct\n   influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n  ceph_decode_32(p) -\u0026gt; ceph_decode_32_safe(p, end, *num_lockers,\n                                           err_inval)\n  ceph_decode_8(p)  -\u0026gt; ceph_decode_8_safe(p, end, *type,\n                                          err_free_lockers)\n\nThe goto targets differ intentionally:\n  err_inval: is a new label returning -EINVAL directly. It is used for\n  the pre-allocation failure path where *lockers is not yet allocated\n  and must not be passed to ceph_free_lockers().\n\n  err_free_lockers: is the existing label. It is used for the\n  post-allocation failure path where *lockers is allocated and must\n  be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ](CVE-2026-68082)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\u0026quot;net-gro: Fix GRO flush when receiving a GSO\npacket.\u0026quot;) added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u0026gt;flush may still be\nre-aggregated.\n\nThis allows already-GRO\u0026apos;d packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n  1. Driver: Generated aggregated packet P1 via LRO with frag_list\n  2. Dev A: Receives aggregated fraglist packet and flush flag set\n  3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n  4. Missing flush check allows re-aggregation despite flush flag\n  5. Frag_list chain becomes corrupted (loops or dangling refs)\n  6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n  The check at line ~4891:\n    if (hsize \u0026lt;= 0 \u0026amp;\u0026amp; i \u0026gt;= nfrags \u0026amp;\u0026amp; skb_headlen(list_skb) \u0026amp;\u0026amp;\n        (skb_headlen(list_skb) == len || sg)) {\n\n  When frag_list is corrupted by double aggregation, when list_skb is\n  a NULL pointer from skb-\u0026gt;next, skb_headlen(list_skb) dereference\n  NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u0026gt;flush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive().(CVE-2026-68136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n  Write of size 4 ... by task exploit\n   kasan_report (mm/kasan/report.c:595)\n   ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n   calc_target (net/ceph/osd_client.c:1638)\n   __submit_request (net/ceph/osd_client.c:2394)\n   ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n   ceph_osdc_call (net/ceph/osd_client.c:5164)\n   rbd_dev_image_probe (drivers/block/rbd.c:6899)\n   do_rbd_add (drivers/block/rbd.c:7138)\n   ...\n  kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ](CVE-2026-68159)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()\n\nThe v4l2 helper v4l2_async_register_subdev_sensor() calls\nv4l2_async_register_subdev(), which is a macro that expands to\n__v4l2_async_register_subdev(sd,THIS_MODULE). Since the macro is expanded\ninside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module\nrather than the sensor driver module that originally set sd-\u0026gt;owner. When\nv4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which then\noverwrites the sensor driver\u0026apos;s owner with NULL.\n\nThis causes the problem that the sensor module\u0026apos;s reference count is never\nincremented during async registration, so the module can be removed while\nthe subdevice is still in use by a notifier (e.g., a CSI-2 receiver\nbridge driver).\n\nFix this by renaming v4l2_async_register_subdev_sensor() to\n__v4l2_async_register_subdev_sensor() with an added explicit module\nargument and introducing a wrapper macro:\n    #define v4l2_async_register_subdev_sensor(sd) \\\n        __v4l2_async_register_subdev_sensor(sd, THIS_MODULE)\n\nThis ensures the sensor driver module is properly referenced even when\nthe sensor driver does not init the owner field before calling\nv4l2_async_register_subdev_sensor() and prevents premature module removal.(CVE-2026-68205)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u0026gt;prev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u0026gt;prev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u0026gt;prev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u0026gt;xmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u0026gt;prev is never updated.  If the\nlast segment is the one stolen, the returned head still has -\u0026gt;prev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed.  validate_xmit_skb_list() later does tail-\u0026gt;next = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u0026gt;prev at the last retained segment before returning.(CVE-2026-68426)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment](CVE-2026-68471)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register bounds before narrowing retval range in check_mem_access()\n\nWhen the BPF verifier processes a context load of an LSM hook return\nvalue, it calls __mark_reg_s32_range() to narrow the register to the\nhook\u0026apos;s valid range. However, __mark_reg_s32_range() intersects the new\nrange with the register\u0026apos;s existing bounds using max_t()/min_t() rather\nthan replacing them.\n\nIf the destination register carries stale bounds from a prior instruction\n(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than\nreality. The verifier then believes it knows the register\u0026apos;s exact value,\nwhile at runtime the actual hook return value is loaded, creating a\nverifier/runtime mismatch that can be used to bypass BPF memory safety\nchecks.\n\nThe else branch already calls mark_reg_unknown() to reset register state\nbefore any narrowing. Apply the same reset in the is_retval path so\nstale bounds are cleared before __mark_reg_s32_range() intersects.(CVE-2026-72111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch\n\nIn alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd\nand non-rsvd hugetlb cgroup charges.  When map_chg is set,\nhugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but\nthe immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg\nwith the non-rsvd cgroup pointer.\n\nAs a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong\n(non-rsvd) cgroup pointer into the folio\u0026apos;s rsvd slot.\n\nWhen the folio is later freed, free_huge_folio() unconditionally calls\nboth hugetlb_cgroup_uncharge_folio() and\nhugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the\nwrong cgroup from the folio and decrements a counter that was never\ncharged for that cgroup, causing a page_counter underflow:\n\n  page_counter underflow: -512 nr_pages=512\n  WARNING: mm/page_counter.c:61 at page_counter_cancel\n\nFix this by introducing a separate h_cg_rsvd pointer exclusively for the\nrsvd charge path, keeping the rsvd and non-rsvd charges fully independent\nthrough their charge, commit, and error uncharge paths.(CVE-2026-72213)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling\n\nHyunwoo Kim reports some really bad races should the following\nsituation occur:\n\n- LPI-I is pending in vcpu-B\u0026apos;s AP list\n- vcpu-A writes to vcpu-B\u0026apos;s RD to disable its LPIs\n- vcpu-C moves I from B to C\n\nIf the last two race nicely enough, vgic_prune_ap_list() can drop\nthe irq and AP list locks, reacquire them, and in the interval\nthe irq has been freed. UAF follows.\n\nThe fix is two-fold:\n\n- Before dropping the irq and ap_list locks, take a reference on\n  the irq\n\n- Do not try to handle migration of the pending bit: there is no\n  expectation that this state is retained, as per the architecture\n\nWith that, we\u0026apos;re sure that the interrupt is still around, and we\nsafely remove it from the AP list as it has no target at this\nstage (unless another interrupt fires, but that\u0026apos;s another story).(CVE-2026-72288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()\n\nFunction kvm_vcpu_ioctl_interrupt() can be called from userspace, here\nadd irq validility cheking in kvm_vcpu_ioctl_interrupt().(CVE-2026-72294)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026amp;im-\u0026gt;refcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u0026gt; for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u0026gt; igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026amp;im-\u0026gt;refcnt),\nand deferring the put until after the spinlock is released.(CVE-2026-72321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup.(CVE-2026-72329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk-\u0026gt;chunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer.(CVE-2026-72398)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()\n\nTIPC UDP media bearer teardown calls dst_cache_destroy() on its\nreplicast caches before calling synchronize_net() to wait for\nconcurrent RCU readers (transmitters) to finish:\n\nstatic void cleanup_bearer(struct work_struct *work)\n{\n...\n\tlist_for_each_entry_safe(rcast, tmp, \u0026amp;ub-\u0026gt;rcast.list, list) {\n\t\tdst_cache_destroy(\u0026amp;rcast-\u0026gt;dst_cache);\n\t\tlist_del_rcu(\u0026amp;rcast-\u0026gt;list);\n\t\tkfree_rcu(rcast, rcu);\n\t}\n...\n\tdst_cache_destroy(\u0026amp;ub-\u0026gt;rcast.dst_cache);\n\tudp_tunnel_sock_release(ub-\u0026gt;sk);\n\tsynchronize_net();\n...\n}\n\nThis is highly buggy because dst_cache_destroy() immediately frees the\nper-CPU cache memory (free_percpu()) and releases the cached dst\nentries without any synchronization.\n\nIf a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another\nCPU under RCU protection, it can call dst_cache_get() concurrently,\nleading to:\n1. Use-After-Free on the per-CPU cache pointer itself (crash).\n2. \u0026quot;rcuref - imbalanced put()\u0026quot; warning if it attempts to release a\n   dst that was concurrently released by dst_cache_destroy().\n\nFurthermore, calling kfree(ub) immediately after synchronize_net() without\nclosing the socket first (or waiting after closing it) leaves a window\nwhere a concurrent receiver (tipc_udp_recv()) could start after\nsynchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.\n\nTo fix this, we must defer dst_cache_destroy() and kfree(ub) until after\nwe have ensured that no more readers can see the bearer/socket and all\nexisting readers have finished:\n\n1. Defer rcast entry destruction (both dst_cache_destroy() and kfree())\n   to an RCU callback using call_rcu_hurry().\n   Using call_rcu_hurry() ensures the dst entries are released quickly.\n\n2. Release the bearer socket using udp_tunnel_sock_release() (stops\n   new receive readers).\n\n3. Call synchronize_net() to wait for all outstanding RCU readers\n   (both transmit and receive) to finish.\n\n4. Now that it is safe, call dst_cache_destroy() on the main bearer\n   cache, and free ub.\n\nNote: 3) and 4) can be changed later in net-next to also use\ncall_rcu_hurry() and get rid of the synchronize_net() latency.(CVE-2026-72404)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync\n\nYue Sun reported a use-after-free and debugobjects warning in\nudp_tunnel_nic_device_sync_work() during concurrent device operations.\n\nThe workqueue core clears the internal pending bit before invoking the\nworker. At that point, a concurrent thread can queue the work again.\nWhen the already running worker eventually clears the work_pending flag\nto 0, it mistakenly clears the flag for the newly queued instance.\nudp_tunnel_nic_unregister() then observes work_pending as 0 and frees\nthe structure while the second work item is still active in the queue,\nleading to UAF.\n\nFix this by returning early in udp_tunnel_nic_device_sync() if\nwork_pending is already set, preventing redundant work queueing.(CVE-2026-72405)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts-\u0026gt;error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts-\u0026gt;error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts-\u0026gt;error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts-\u0026gt;error.(CVE-2026-72423)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix UAF in hci_unregister_dev()\n\nhci_unregister_dev() does not disable cmd_timer and ncmd_timer\nbefore the hci_dev structure is freed. If a timeout fires\nduring device teardown, the callback dereferences freed memory\n(including the hdev-\u0026gt;reset function pointer), leading to a\nuse-after-free.\n\nAdd disable_delayed_work_sync() calls alongside the existing\ndisable_work_sync() calls to ensure both timers are fully\nquiesced before teardown proceeds.(CVE-2026-74302)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: do not configure xps for XDP queues\n\nnetif_set_xps_queue() should not be called for an XDP Tx queue, since such\nqueues are not netdev-exposed. On systems with number of CPUs \u0026gt;=64, on E610\nadapter, netdev is configured with maximum number queue pairs being 63\n(due to MSI-X assignment), but configuring XDP results in 64 XDP queues.\n\nSo, during XDP program load, when netif_set_xps_queue() is called for the\nlast XDP queue, we get a WARNING with a call trace and KASAN report\nafterwards (if enabled).\n\n[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668\n[...]\n[ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40\n[ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff \u0026lt;0f\u0026gt; 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84\n[ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246\n[ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000\n[ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488\n[ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000\n[ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8\n[ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8\n[ 2012.700065] FS:  00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000\n[ 2012.700069] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0\n[ 2012.700077] PKRU: 55555554\n[ 2012.700080] Call Trace:\n[ 2012.700084]  \u0026lt;TASK\u0026gt;\n[ 2012.700087]  ? ktime_get+0x61/0x150\n[ 2012.700097]  ? usleep_range_state+0x133/0x1b0\n[ 2012.700108]  ? __pfx_usleep_range_state+0x10/0x10\n[ 2012.700114]  netif_set_xps_queue+0x31/0x50\n[ 2012.700119]  ixgbe_configure_tx_ring+0x472/0x920 [ixgbe]\n[...]\n[ 2012.700486]  ixgbe_xdp+0x38f/0x750 [ixgbe]\n\n[...]\n\n[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40\n[ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668\n\nSkip XPS configuration for XDP Tx queues.(CVE-2026-74317)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix page fragment cache leak in error path\n\nIn nvmet_tcp_alloc_queue(), when a connection is closed during the\nallocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),\nthe error handling jumps to out_destroy_sq and then to out_ida_remove\nwithout draining the page fragment cache.\n\nAlthough nvmet_tcp_free_cmd() is called in some error paths to release\nindividual page fragments, the underlying page cache reference held by\nqueue-\u0026gt;pf_cache is never released. The first allocation using pf_cache\nis the call to nvmet_tcp_alloc_cmd() for queue-\u0026gt;connect, which happens\nafter ida_alloc() returns successfully. This results in a page leak each\ntime a connection fails during allocation, which could lead to memory\nexhaustion over time if connections are repeatedly opened and closed.\n\nFix this by calling page_frag_cache_drain() before freeing the queue\nstructure in the out_ida_remove label.(CVE-2026-74386)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down scalable-mode context entry\n\ndevice_pasid_table_teardown() zeroes the 128-bit scalable-mode context\nentry with context_clear_entry() while the Present bit is still set. This\ncreates a window where the hardware can fetch a torn entry, with some\nfields already zeroed while Present is still set, leading to unpredictable\nbehavior or spurious faults. The context-cache invalidation is issued only\nafter the entry has been zeroed, and intel_pasid_free_table() then frees\nthe PASID directory pages, so the IOMMU can keep walking a stale Present=1\nentry that points at freed memory.\n\nWhile x86 provides strong write ordering, the compiler may reorder the two\n64-bit writes to the entry, and the hardware fetch is not guaranteed to be\natomic with respect to multiple CPU writes.\n\nCommit c1e4f1dccbe9d (\u0026quot;iommu/vt-d: Clear Present bit before tearing down\ncontext entry\u0026quot;) fixed this exact pattern in domain_context_clear_one() and\nthe copied-context path, but device_pasid_table_teardown() was not\nconverted.\n\nAlign it with the \u0026quot;Guidance to Software for Invalidations\u0026quot; in the VT-d\nspec, Section 6.5.3.3, using the same ownership handshake as the sibling\nfix: clear only the Present bit, flush it to the IOMMU, perform the\ncontext-cache invalidation, and only then zero the rest of the entry.(CVE-2026-74439)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb-\u0026gt;data.\n\nHowever, in vxlan_xmit(), skb-\u0026gt;data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb-\u0026gt;data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)-\u0026gt;daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer.(CVE-2026-74473)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n-\u0026gt;ha can be updated asynchronously by the\nneighbour subsystem, protected by n-\u0026gt;ha_lock seqlock. Reading n-\u0026gt;ha without\nholding the seqlock loop can lead to torn reads or reading a partially updated\nMAC address.\n\nUse neigh_ha_snapshot() in route_shortcircuit() to safely copy n-\u0026gt;ha under\nread_seqbegin()/read_seqretry() lock protection before using it.\n\nNote that arp_reduce() and neigh_reduce() seem to have the same issue\nleft for future patches.(CVE-2026-74475)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.(CVE-2026-74476)\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend. During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete their virtqueues via vdev-\u0026gt;config-\u0026gt;del_vqs(). However, page reporting work (page_reporting_process) was scheduled on the global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM freezer skips it, leaving page_reporting_process active during suspend. If pages are freed into the buddy allocator while suspending, page reporting triggers virtballoon_free_page_report() on deleted virtqueues, resulting in a Use-After-Free / General Protection Fault.(CVE-2026-74481)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter.\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters \u0026apos;P\u0026apos;, \u0026apos;O\u0026apos;, \u0026apos;C\u0026apos; and \u0026apos;F\u0026apos; and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character.(CVE-2026-74485)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode\u0026apos;s i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\u0026quot;binfmt_misc: restore write access before\nclosing files opened by open_exec()\u0026quot;) fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file.(CVE-2026-74487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\\n\\nsnd_usbmidi_akai_output() computes its fill-loop bound\\n\\n\\tbuf_end = ep-\u0026gt;max_transfer - MAX_AKAI_SYSEX_LEN - 1;\\n\\nas a signed int, so a small device-advertised bulk-OUT max_transfer\\nmakes buf_end negative.  The loop guard then compares the u32\\nurb-\u0026gt;transfer_buffer_length against that negative int: the usual\\narithmetic conversion turns buf_end into a large unsigned value, so the\\nguard stays true and each iteration keeps appending SysEx framing and\\npayload bytes past the end of the URB transfer buffer, which is only\\nmax_transfer bytes long.\\n\\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\\ntrigger an attacker-length- and content-controlled heap out-of-bounds\\nwrite when a process writes to the created /dev/snd/midiC*D* node.\\n\\nReturn early when there is no room for even one SysEx, so the loop is\\nnever entered with a bound that would wrap.  The loop is the last\\nstatement of the function, so bailing out is equivalent to it not\\nrunning.\\n\\nDiscovered by XBOW, triaged by Baul Lee \u0026amp;lt;baul.lee@xbow.com\u0026amp;gt;(CVE-2026-74499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix memory accounting for pinned/unpinned pages\n\nThe account_mem() and unaccount_mem() functions call get_uid() which\nincrements the reference count of struct user_struct on every invocation.\nBut we don\u0026apos;t decrement the count by calling free_uid(). It also\naccounted/unaccounted the pages against the current-\u0026gt;mm. But its possible\nthe unaccount_mem() can be called from a different process context than the\none that originally pinned the pages.\n\nLet\u0026apos;s fix this by storing the pinning process user_struct and mm_struct\nwhen accounting for pinned pages, and subsequently free these resources\nwhen the pages are unpinned.\n\n[(CVE-2026-74514)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix leaking sk after socket release\n\niso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk-\u0026gt;sk_socket ||\nsock_flag(sk, SOCK_DEAD) for early return, but this is always true since\nsock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket\nalways leaks, iso_sock_destruct is never called.\n\nThe socket reference also leaks when __iso_sock_close() does not set\nSOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after\nzapping.\n\nFix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for\nsomething else, and lock_sock to ensure iso_sock_kill() puts sk only\nafter socket release only once. Release and iso_conn_del may run\nconcurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up\nafter zapping.\n\nRemove call to iso_sock_kill() from iso_sock_close(), as it\u0026apos;s generally\nno-op there.(CVE-2026-74536)\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer. sctp_process_asconf_param() stores a newly added peer transport in asoc-\u0026gt;new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same chunk. The wildcard deletion preserves the transport on which the ASCONF arrived, but removes the newly added transport through sctp_assoc_del_nonprimary_peers(). The removal does not clear asoc-\u0026gt;new_transport, leaving it pointing to the removed transport. sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u0026gt;transport points to the removed transport without holding a transport reference. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads the freed transport\u0026apos;s state, leading to a use-after-free condition.(CVE-2026-74586)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: fix use-after-free of cached ASCONF chunk\\n\\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\\nASCONF-ACK completion path releases the chunk and clears the pointer.\\n\\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\\nclearing addip_last_asconf. During peer restart handling,\\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\\nsctp_asconf_queue_teardown() while the association remains alive and leaves\\nthe pointer dangling.\\n\\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\\ncausing a use-after-free and a second release.\\n\\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\\ntimer_delete(), which does not wait for a callback already running on\\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\\nthe purge and dereference NULL.\\n\\nClear addip_last_asconf after releasing the cached chunk, and make\\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\\nASCONF remains.(CVE-2026-74587)\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-\u0026gt;transport in step with the list it is queued on. __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0026apos;s transmitted list without updating chunk-\u0026gt;transport. The chunk then sits on a live transport\u0026apos;s list while chunk-\u0026gt;transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. A SACK that reneges on the TSN clears the flag, and the next SACK reaches inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer().(CVE-2026-74588)\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict. sk_psock_msg_verdict() takes a socket reference for psock-\u0026gt;sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir(). When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer, leading to a use-after-free. KASAN reported a slab-use-after-free error.(CVE-2026-74589)\n\nIn the Linux kernel, in __filemap_add_folio()\u0026apos;s split-a-conflict loop, xas_set_order() is applied repeatedly, each time modifying xas.xa_index by rounding it down according to the split_order attempted. When a new node is needed but GFP_NOWAIT allocation fails, the lock is dropped, xas_nomem() is used to allocate memory, and the sequence is retried. If the conflict was meanwhile resolved by another thread (e.g., inserting a folio at the same index), the current thread may put the folio into the xarray at an intermediate rounded-down index, causing a race condition. This can lead to rare SIGILLs and SIGSEGVs in production, and triggers the !folio_contains() bug when CONFIG_DEBUG_VM=y is enabled.(CVE-2026-74591)\n\nIn the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec(). eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running.(CVE-2026-74606)\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels(). cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface-\u0026gt;weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.(CVE-2026-74608)\n\nIn the Linux kernel, the following vulnerability has been resolved: tipc: read le-\u0026gt;link under the node lock in tipc_node_link_down(). tipc_node_link_down() caches the link pointer before taking n-\u0026gt;lock. The delete=true caller frees that very object under n-\u0026gt;lock, so the lock does not protect the cached pointer against it. An in-flight CPU that has read l therefore dereferences freed memory once another CPU frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.(CVE-2026-74609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0026apos;t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the \u0026quot;tls\u0026quot; ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.(CVE-2026-74610)\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry. tls_decrypt_sg() advances msg-\u0026gt;msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD.(CVE-2026-74611)\n\nIn the Linux kernel, the veth driver has an skb length accounting error after XDP frag adjustment. veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb-\u0026gt;data_len but leaves skb-\u0026gt;len containing the old fragment contribution. After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. Additionally, bpf_xdp_pull_data() can advance data_end while leaving frags present, and the old __skb_put(skb, off) triggers SKB_LINEAR_ASSERT().(CVE-2026-74612)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nvsock/virtio: read virtqueues under worker locks\\n\\nCommit bd50c5dc182b (\u0026quot;vsock/virtio: add support for device suspend/resume\u0026quot;) made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue\u0026apos;s running state while retaining a pointer to the deleted queue.\\n\\nRead each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.(CVE-2026-74614)\n\nIn the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down. vxlan_changelink() arms vxlan-\u0026gt;age_timer whenever the requested ageing interval differs from the configured one, but there is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device. When free_netdev() releases the allocation, the timer lives in freed memory while still queued on a timer_base, causing a use-after-free condition that can lead to system crash or code execution.(CVE-2026-74615)\n\nIn the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom. xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone\u0026apos;s required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.(CVE-2026-74616)\n\nIn the Linux kernel, an input validation vulnerability exists in the net/sched subsystem. The act_gact and act_police modules lack range checking on the fallback control action. The tcf_action_check_ctrlact() function performs range checking on the primary control action, but act_gact and act_police each carry a second, independent control action supplied by user space (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) that never reaches that helper. User space can set TC_ACT_CONSUMED (TC_ACT_VALUE_MAX + 1), which tells callers the action took ownership of the skb, resulting in memory leaks of sk_buff and its data buffer - one leaked sk_buff per packet traversing the filter.(CVE-2026-74620)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: atlantic: free stranded TX buffers on ring deinit\\n\\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer moves once aq_vec_stop() has stopped the hardware and NAPI. Completed descriptors beyond the budget and everything still posted in [hw_head, sw_tail) keep their skb or xdp_frame when the interface goes down: aq_vec_ring_free() then frees the buffer ring and the references are lost for good.\\n\\nToday this is a silent memory leak on every interface down under TX/XDP_TX load. With the conversion of the RX path to page_pool posted for net-next it becomes much more visible: XDP_TX frames carry fragment references on the RX ring\u0026apos;s page_pool, so a single stranded frame keeps the pool\u0026apos;s inflight count above zero forever. page_pool_destroy() then never completes, the pool is leaked together with its pages, and \\\u0026quot;page_pool_release_retry() stalled pool shutdown\\\u0026quot; is warned every 60 seconds from that point on, on every ifdown, XDP detach or ring resize under XDP_TX load.(CVE-2026-74623)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct-\u0026gt;lock is still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct-\u0026gt;lock, so logging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while ct-\u0026gt;lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached while ct-\u0026gt;lock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct-\u0026gt;lock are caught outside TCP and SCTP as well.(CVE-2026-74624)\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and event_define_fields. The following sequence may lead to a race between event_define_fields() and update_event_fields(): CPU0 (loads module A) and CPU1 (loads module B) executing concurrently, where access to class-\u0026gt;fields is not protected by event_mutex in trace_event_update_all(), leading to a kernel panic. Fix by taking event_mutex in trace_event_update_all() before trace_event_sem.(CVE-2026-74636)\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach. perf_group_detach() handles leader and sibling detach differently. When a sibling is detached, it is removed from the leader\u0026apos;s sibling_list, but its group_leader pointer is left pointing at the old leader. This is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. A PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale group_leader pointer and dereferences the freed leader\u0026apos;s context, leading to a use-after-free condition.(CVE-2026-74637)\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu(). fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock. The following interleaving can therefore occur: CPU 0 (fib_nhc_update_mtu) loads fnhe while CPU 1 (update_or_create_fnhe) holds fnhe_lock, calls fnhe_remove_oldest() to unlink fnhe, and kfree_rcu(fnhe, rcu). CPU 0 then accesses fnhe after grace period, causing a use-after-free. KASAN reported: BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410.(CVE-2026-74656)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving causes a use-after-free condition where CPU 1 dereferences per-net state after CPU 0 has freed it.(CVE-2026-74660)\n\nIn the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer. inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.(CVE-2026-74662)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\npacket: synchronize pressure clearing with ring reconfiguration\\n\\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po-\u0026gt;prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage.(CVE-2026-74666)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb-\u0026gt;mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb-\u0026gt;head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c (\u0026quot;macsec: do not read an unset MAC header in macsec_encrypt()\u0026quot;).\n\npacket_parse_headers() runs only on the transmit path, where skb-\u0026gt;data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.(CVE-2026-74667)\n\nIn the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors. ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)-\u0026gt;opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.(CVE-2026-74669)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: stop estimator after disabled calc phase\n\nIPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-\u0026gt;enable during that phase, ip_vs_est_calc_phase() can return without installing positive limits.\n\nThe kthread can then continue into its main loop and drain est_temp_list with zero chain_max, tick_max and est_max_count values. Each enqueue consumes one available tick row, but est_count never reaches the zero est_max_count value. After all rows are consumed, the row lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays, causing a buffer overflow.\n\nExit kthread 0 after the calculation phase if the kthread is stopping or IPVS has been disabled. That keeps temporary estimators from being drained after the limits failed to initialize.\n\nEstimator kthreads can now self-exit before teardown or reload stops kd-\u0026gt;task. Keep an extra task reference after creation and release it with kthread_stop_put(), so kd-\u0026gt;task remains valid until the stop paths consume that reference.(CVE-2026-74670)\n\nIn the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values(). In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized. When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information. Similar issues exist in __evdev_queue_syn_dropped and __pass_event. Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary.(CVE-2026-74673)\n\nIn the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks. The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask(). While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads. Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds, preventing any speculative memory access to client evmasks array.(CVE-2026-74683)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tap: set skb-\u0026gt;dev before parsing virtio net header in tap_get_user_xdp()\\n\\nThe commit 4f61f133f354 (\u0026quot;net: tap: NULL pointer derefence in dev_parse_header_protocol when skb-\u0026gt;dev is null\u0026quot;) fixed a crash in tap_get_user() by assigning skb-\u0026gt;dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb-\u0026gt;dev. Without the assignment, a NULL pointer dereference can occur.\\n\\nHowever, tap_get_user_xdp() still parses the virtio-net header before assigning skb-\u0026gt;dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb-\u0026gt;dev is still NULL, resulting in a crash.\\n\\nFix this by looking up the tap device and assigning skb-\u0026gt;dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().(CVE-2026-74684)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: clear control chunk transport if it is being removed\\n\\nsctp_make_heartbeat_ack() caches the destination transport in chunk-\u0026gt;transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.\\n\\nIf the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.\\n\\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.\\n\\nFix this by also clearing chunk-\u0026gt;transport for queued control chunks in control_chunk_list when removing the transport.(CVE-2026-74688)\n\nIn the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration. A listener\u0026apos;s TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener\u0026apos;s qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue-\u0026gt;young and queue-\u0026gt;qlen.(CVE-2026-74696)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u0026gt;head,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free.(CVE-2026-74705)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller\u0026apos;s temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent.(CVE-2026-74720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\\n\\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -\u0026gt; __bond_release_one() -\u0026gt; bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave\u0026apos;s promiscuity counter and pins it in IFF_PROMISC.\\n\\n  Oops: general protection fault, probably for non-canonical address ...\\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\n  Workqueue: b42 bond_alb_monitor\\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\\n   process_one_work (kernel/workqueue.c:3322)\\n   worker_thread (kernel/workqueue.c:3486)\\n   kthread (kernel/kthread.c:436)\\n   ret_from_fork (arch/x86/kernel/process.c:158)\\n  Kernel panic - not syncing: Fatal exception\\n\\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.(CVE-2026-74726)\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class(). u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses \u0026amp;n-\u0026gt;res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res-\u0026gt;classid in tc_cls_bind_class().(CVE-2026-74739)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n   in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.(CVE-2026-74744)\n\nIn the Linux kernel, the netfilter/ipset component has a refcount race condition vulnerability. __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set-\u0026gt;ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets\u0026apos; ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set-\u0026gt;ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -\u0026gt; ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. This vulnerability can cause kernel panic.(CVE-2026-74748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Reject exited events as group leaders\n\nperf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event\u0026apos;s file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events.\n\nA new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event.\n\nReject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment.\n\n[peterz: make the earlier test fully consistent](CVE-2026-74753)\n\nIn the Linux kernel, a deadlock vulnerability has been found in the ceph filesystem. A reader can hang forever in __ceph_get_caps() when the client no longer holds FILE_RD, but local cap state still says that the capability is already wanted (via mds_wanted). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke FILE_RD from the reader; the next read then has to reacquire FILE_RD. If the cap update that should request FILE_RD never reaches the MDS after cap-\u0026gt;mds_wanted was raised, the reader is left holding only non-file caps while local mds_wanted still includes the file read caps, causing the reader to wait indefinitely.(CVE-2026-80527)\n\nIn the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-\u0026gt;journal_info. handle_reply() stores a ceph_mds_request pointer in current-\u0026gt;journal_info while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in current-\u0026gt;journal_info as a journal handle and dereferences the request\u0026apos;s r_tid as h_transaction, causing a kernel crash.(CVE-2026-80528)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nxfs: don\u0026apos;t swallow dquot recovery verification errors\\n\\nxlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.(CVE-2026-80529)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix OOB read in decode_watchers() via missing bounds check\n\nceph_start_decoding() validates that struct_len bytes remain in the\nbuffer after the encoding header, but accepts struct_len=0 as valid:\nceph_decode_need(p, end, 0, bad) always passes. When a malicious or\ncompromised OSD sends an obj_list_watch_response_t reply with\nstruct_len=0, ceph_start_decoding() returns success with p == end,\nleaving zero bytes guaranteed for subsequent reads.\n\nThe immediately following ceph_decode_32(p) in decode_watchers() has\nno preceding bounds check. With p == end this is a 4-byte read past\nthe validated buffer boundary. The garbage value is then passed\ndirectly to kzalloc_objs() as the watcher count.\n\nThe sibling function decode_watcher() already uses the safe variants\n(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)\nafter its own ceph_start_decoding() call. decode_watchers() is the\nonly site that uses the bare variant, confirming an oversight.\n\nFix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end,\n*num_watchers, bad), consistent with the established pattern.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment (e.g. cloud) can trigger this against any kernel client\nthat calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges\nbeyond OSD session establishment.\n\n[ idryomov: trim changelog ](CVE-2026-80557)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Avoid using invalid osd indices from primary_temp\n\nA corrupted osdmap received from a Ceph monitor or OSD may contain osd\nindices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts\nthat don\u0026apos;t exist, i.e., that are greater than max_osd or smaller than\nCEPH_HOMELESS_OSD (-1). These indices are used to create the up and\nacting set in ceph_pg_to_up_acting_osds(), called from calc_target().\nWhile most of these osd indices are checked, the one from primary_temp\nis not. Subsequently, this may lead to calc_target() returning this\n(potentially invalid) index as target osd for a (linger) request.\nBecause the osd_state, osd_weight, and osd_addr arrays only contain\nmax_osd entries (with indices 0 to max_osd -1), this leads to\nout-of-bounds accesses when trying to read values from these arrays.\n\nThis patch fixes the issue by adding a check to get_temp_osds(), so that\nonly valid osd indices from primary_temp are used, and it falls back to\nusing the primary from pg_temp or the up set if it is invalid.\n\n[ idryomov: changelog ](CVE-2026-80558)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: avoid combining some incoming suboptions\\n\\nSome MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn\u0026apos;t expect some combinations to be present. That\u0026apos;s specially true for suboptions that would be present twice, but with different attributes.\\n\\nThe new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux.(CVE-2026-80587)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: stop the timeout timer when releasing a never added disk\n\ndisk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q-\u0026gt;timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket.\n\nCommit 6f8191fdf41d (\u0026quot;block: simplify disk shutdown\u0026quot;) dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it.\n\nnvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns-\u0026gt;queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed, leading to a use-after-free condition.(CVE-2026-80589)\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg. Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove the WARN_ON_ONCE().(CVE-2026-80607)\n\nIn the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix warning in poll cq direct mode\\n\\nCQs allocated by ib_alloc_cq() always have a comp_handler. Though\\nin direct mode this handler is never expected to be called, it\\nis still called when the driver is reset, triggering the following\\nWARN_ONCE():\\n\\nCall trace:\\nib_cq_completion_direct+0x38/0x60\\nhns_roce_cq_completion+0x54/0x90 (hns_roce_hw_v2]\\nhns_roce_handle_device_err+Ox1c8/0x340 [hns_roce_hw_v2]\\nhns_roce_hw_v2_uninit_instance.constprop.0+0x34/0x70 [hns_roce_hw_v2]\\nhns_roce_hw_v2_reset_notify+0xc4/0xe0 [hns_roce_hw_v2]\\nhclge_notify_roce_client+0x60/0xbc [hclge]\\nhclge_reset_rebuild+0x48/0x34c [hclge]\\nhclge_reset_subtask+0xcc/0xec [hclge]\\nhclge_reset_service_task+0x80/0x160 [hclge]\\nhclge_service_task+0x50/0x80 (hclge]\\nprocess_one_work+0x1cc/0x4d0\\nworker_thread+0x154/0x414\\nkthread+0x104/0x144\\nret_from_fork+0x10/0x18(CVE-2026-80647)","status":"published","published":"2026-09-14T16:33:36Z","modified":"2026-09-13T16:45:53.041288222Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-4357","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist\n\nIndex allocation requires at least one bit in the $BITMAP attribute to\ntrack usage of index entries. If the bitmap is empty while index blocks\nare already present, this reflects on-disk corruption.\n\nsyzbot triggered this condition using a malformed NTFS image. During a\nrename() operation involving a long filename (which spans multiple\nindex entries), the empty bitmap allowed the name to be added without\nvalid tracking. Subsequent deletion of the original entry failed with\n-ENOENT, due to unexpected index state.\n\nReject such cases by verifying that the bitmap is not empty when index\nblocks exist.(CVE-2025-40067)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix fragment reassembly length accounting\n\nbatman-adv keeps a running payload length for queued fragments and uses it\nto validate a fragment chain before reassembly.\n\nThat accounting currently allows the accumulated fragment length to be\ntruncated during updates. As a result, malformed fragment chains can\nbypass the intended validation and drive reassembly with inconsistent\nlength state, leading to a local denial of service.\n\nFix the accounting by storing the accumulated length in a length-typed\nfield and rejecting update overflows before the existing validation logic\nruns.\n\nThe fix was verified against the original reproducer and against valid\nfragment reassembly paths.(CVE-2026-52914)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix listxattr handling when the buffer is full\n\n[BUG]\nIf an OCFS2 inode has both inline and block-based xattrs, listxattr()\ncan return a size larger than the caller\u0026apos;s buffer when the inline names\nconsume that buffer exactly.\n\nkernel BUG at mm/usercopy.c:102!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102\nCall Trace:\n __check_heap_object+0xe3/0x120 mm/slub.c:8243\n check_heap_object mm/usercopy.c:196 [inline]\n __check_object_size mm/usercopy.c:250 [inline]\n __check_object_size+0x5c5/0x780 mm/usercopy.c:215\n check_object_size include/linux/ucopysize.h:22 [inline]\n check_copy_size include/linux/ucopysize.h:59 [inline]\n copy_to_user include/linux/uaccess.h:219 [inline]\n listxattr+0xb0/0x170 fs/xattr.c:926\n filename_listxattr fs/xattr.c:958 [inline]\n path_listxattrat+0x137/0x320 fs/xattr.c:988\n __do_sys_listxattr fs/xattr.c:1001 [inline]\n __se_sys_listxattr fs/xattr.c:998 [inline]\n __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998\n ...\n\n[CAUSE]\nCommit 936b8834366e (\u0026quot;ocfs2: Refactor xattr list and remove\nocfs2_xattr_handler().\u0026quot;) replaced the old per-handler list accounting\nwith ocfs2_xattr_list_entry(), but it kept using size == 0 to detect\nprobe mode.\n\nThat assumption stops being true once ocfs2_listxattr() finishes the\ninline-xattr pass. If the inline names fill the caller buffer exactly,\nthe block-xattr pass runs with a non-NULL buffer and a remaining size of\nzero. ocfs2_xattr_list_entry() then skips the bounds check, keeps\ncounting block names, and returns a positive size larger than the\nsupplied buffer.\n\n[FIX]\nDetect probe mode by testing whether the destination buffer pointer is\nNULL instead of whether the remaining size is zero.\n\nThat restores the pre-refactor behavior and matches the OCFS2 getxattr\nhelpers. Once the remaining buffer reaches zero while more names are\nleft, the block-xattr pass now returns -ERANGE instead of reporting a\nsize larger than the allocated list buffer.(CVE-2026-53041)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026amp; How]\ndal_vector_reserve() computes the allocation size as\n\u0026quot;capacity * vector-\u0026gt;struct_size\u0026quot; using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)(CVE-2026-53329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential use-after-free in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), the buffer_head obtained from\nexfat_get_dentry() is released with brelse(bh) before the fall-through\nTYPE_EXTEND branch reads the directory entry through ep (which points\ninto bh-\u0026gt;b_data):\n\n\tbrelse(bh);\n\tif (entry_type == TYPE_EXTEND) {\n\t\t...\n\t\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\t\t...\n\t}\n\nAfter brelse() drops our reference, nothing guarantees that the\nunderlying page backing bh-\u0026gt;b_data remains valid for the subsequent\nexfat_extract_uni_name() read. This is the same pattern fixed in\ncommit fc961522ddbd (\u0026quot;exfat: Fix potential use after free in\nexfat_load_upcase_table()\u0026quot;).\n\nMove brelse(bh) so it runs after ep is no longer dereferenced on\neach branch.\n\nConfirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y\n+ CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image\n(long filename with same-hash collisions forcing the TYPE_EXTEND path).\nWith a debug-only invalidate_bdev() inserted between brelse(bh) and\nthe ep read to make the stale-deref window deterministic, the\nunpatched kernel faults:\n\n  BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0\n  BUG: unable to handle page fault for address: ffff88801a5fa0c2\n  Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n  RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0\n\nWith this patch applied, the same instrumented harness completes\ncleanly under the same sanitizer stack. I have not reproduced a\ncrash on an uninstrumented kernel under ordinary reclaim; the\ninstrumented A/B establishes the lifetime violation and that the\npatch closes it, not an unaided triggerability claim.(CVE-2026-63808)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: restrict number of unacked list entries\n\nWhen the unacked_list is unbound, an attacker could send messages with\nsmall lengths and appropriated seqno + gaps to force the receiver to\nallocate more and more unacked_list entries. And the end either causing an\nout-of-memory situation or increase the management overhead for the (large)\nlist that significant portions of CPU cycles are wasted in searching\nthrough the list.\n\nWhen limiting the list to a specific number, it is important to still\ncorrectly add a new entry to the list. But if the list became larger than\nthe limit, the last entry of the list (with the highest seqno) must be\ndropped to still allow the earlier seqnos to finish and therefore to\ncontinue the process. Otherwise, the process might get stuck with too high\nseqnos which are not handled by batadv_tp_ack_unordered().(CVE-2026-63834)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: prevent OGM aggregation on disabled hardif\n\nWhen an interface gets disabled, the worker is correctly disabled by\nbatadv_hardif_disable_interface() -\u0026gt; ... -\u0026gt; batadv_v_ogm_iface_disable().\nIn this process, the skb aggr_list is also freed.\n\nBut batadv_v_ogm_send_meshif() can still queue new skbs (via\nbatadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all\ncores can no longer find the RCU protected list of hard interfaces. These\nqueued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.\n\nThe batadv_v_ogm_iface_disable() function must block\nbatadv_v_ogm_queue_on_if() to avoid leak of skbs.(CVE-2026-63835)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf\u0026apos; as a parameter and\nfills the i2c_msg destination as `(char *)\u0026amp;buf\u0026apos;. Since `buf\u0026apos; is the\nparameter (a pointer), `\u0026amp;buf\u0026apos; is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller\u0026apos;s scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter\u0026apos;s stack slot, which is discarded when\nthe function returns. The caller\u0026apos;s scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `\u0026amp;out\u0026apos; on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `\u0026amp;\u0026apos; so the i2c read writes into the caller\u0026apos;s\nbuffer.(CVE-2026-63934)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: fix NULL pointer dereference in team_xmit during mode change\n\n__team_change_mode() clears team-\u0026gt;ops with memset() before restoring\nsafe dummy handlers via team_adjust_ops(). A concurrent team_xmit()\nrunning under RCU on another CPU can read team-\u0026gt;ops.transmit during\nthis window and call a NULL function pointer, crashing the kernel.\n\nThe race requires a mode change (CAP_NET_ADMIN) concurrent with\ntransmit on the team device.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n Oops: 0010 [#1] SMP KASAN NOPTI\n RIP: 0010:0x0\n Call Trace:\n  team_xmit (drivers/net/team/team_core.c:1853)\n  dev_hard_start_xmit (net/core/dev.c:3904)\n  __dev_queue_xmit (net/core/dev.c:4871)\n  packet_sendmsg (net/packet/af_packet.c:3109)\n  __sys_sendto (net/socket.c:2265)\n\nThe original code assumed that no ports means no traffic, so mode\nchanges could freely memset()/memcpy() the ops.  AF_PACKET with\nforced carrier breaks that assumption.\n\nPrevent the race instead of making it safe: replace memset()/memcpy()\nwith per-field updates that never touch transmit or receive.  Those\ntwo handlers are managed solely by team_adjust_ops(), which already\ninstalls dummies when tx_en_port_count == 0 (always true during mode\nchange since no ports are present).  WRITE_ONCE/READ_ONCE prevent\nstore/load tearing on the handler pointers.\n\nsynchronize_net() before exit_op() drains in-flight readers that may\nstill reference old mode state from before port removal switched the\nhandlers to dummies.(CVE-2026-64190)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -\u0026gt; io_ctl_map_page(), which\ndoes io_ctl-\u0026gt;pages[io_ctl-\u0026gt;index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode\u0026apos;s i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl-\u0026gt;pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl-\u0026gt;index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl-\u0026gt;index \u0026gt;= io_ctl-\u0026gt;num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = \u0026lt;N\u0026gt; here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl-\u0026gt;index walks up to 16, and pages[16] is read past the\narray:\n\n  BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n  Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n   io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n   __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n   load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n   caching_thread (fs/btrfs/block-group.c:880)\n   btrfs_work_helper (fs/btrfs/async-thread.c:312)\n   process_one_work\n   worker_thread\n   kthread\n   ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected.(CVE-2026-64567)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: stop hardware after post-start probe failures\n\nwacom_parse_and_register() starts HID hardware before registering inputs\nand initializing pad LEDs/remotes. Those later steps can fail, but their\nerror paths currently release Wacom resources without stopping the HID\nhardware.\n\nRoute post-hid_hw_start() failures through hid_hw_stop() before\nreleasing driver resources.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.(CVE-2026-68091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: make release_scratchbuffers idempotent\n\nbrcmf_pcie_release_scratchbuffers() frees the shared.scratch and\nshared.ringupd DMA buffers with dma_free_coherent() but does not clear\nthe pointers afterwards, unlike the sibling release_ringbuffers() which\nNULLs commonrings/flowrings/idxbuf on release.\n\nBoth the bus_reset .reset callback (brcmf_pcie_reset) and\nbrcmf_pcie_remove() call release_scratchbuffers.  When reset teardown\nhas run before removal, remove\u0026apos;s own teardown would call\ndma_free_coherent() a second time on the already-freed DMA allocation.\n\nNULL the pointers after free, matching release_ringbuffers(), so a later\nrelease observes that the allocation has already been released.  This\npatch makes repeated sequential release safe; the reset-work lifetime is\nhandled separately by the following patch.\n\nThis issue was found by an in-house static analysis tool.(CVE-2026-68192)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n\nThe vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only\nvalid while the lock is still being held. Once xa_unlock_irqrestore is\ncalled and returned, the pointer is no longer under lock and is subject\nto modification. Since, the caller still dereferences vm-\u0026gt;task_info in\namdgpu_vm_get_task_info_vm() after the lock is removed, this causes a\nuse after unlock problem.\n\nRemove the lifetime issue present in amdgpu_vm_get_task_info_pasid()\nthrough removing the amdgpu_vm_get_vm_from_pasid() function from\namdgpu_vm.c and making the relevant code inline to hold the lock while\nit is still in use.\n\n(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)(CVE-2026-68245)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel sched scan results work on unregister\n\ncfg80211_sched_scan_results() can queue rdev-\u0026gt;sched_scan_res_wk from a\ndriver result notification while a scheduled scan request is present. The\nwork callback recovers the containing cfg80211_registered_device and then\nlocks the wiphy and walks the scheduled-scan request list.\n\nwiphy_unregister() already makes the wiphy unreachable and drains rdev work\nitems before cfg80211_dev_free() can release the object, but it does not\ndrain sched_scan_res_wk. A queued or running result work item can therefore\ncross the unregister/free boundary and access freed rdev state.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nscheduled-scan result path:        unregister/free path:\n1. cfg80211_sched_scan_results()   1. interface teardown stops and\n   queues rdev-\u0026gt;sched_scan_res_wk.    removes the scheduled scan request.\n2. cfg80211_wq starts the work     2. wiphy_unregister() drains other\n   item and recovers rdev.            rdev work items.\n3. The worker locks rdev-\u0026gt;wiphy    3. cfg80211_dev_free() destroys and\n   and walks rdev state.              frees rdev.\n\nCancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev\nwork items. cancel_work_sync() removes a pending result notification and\nwaits for an already running callback, so cfg80211_dev_free() cannot free\nrdev while this work item is still active.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530\nWorkqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  cfg80211_sched_scan_results_wk+0x4a6/0x530\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x224/0x430\n  kasan_report+0xac/0xe0\n  lockdep_hardirqs_on_prepare+0xea/0x1a0\n  process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212)\n  lock_is_held_type+0x8f/0x100\n  worker_thread+0x5ad/0xfd0\n  __kthread_parkme+0xc6/0x200\n  kthread+0x31e/0x410\n  trace_hardirqs_on+0x1a/0x170\n  ret_from_fork+0x576/0x810\n  __switch_to+0x57e/0xe20\n  __switch_to_asm+0x33/0x70\n  ret_from_fork_asm+0x1a/0x30(CVE-2026-68414)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00: avoid full teardown before work setup in probe\n\nrt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for\nall probe failures. However, drv_data allocation and workqueue allocation\ncan fail before intf_work, autowakeup_work and sleep_work have been\ninitialized.\n\nDo not enter the full remove path until the probe has reached the point\nwhere those work items are set up. Return directly for drv_data allocation\nfailure, and use a small early cleanup path for workqueue allocation\nfailure.\n\nThis issue was found by our static analysis tool and then confirmed by\nmanual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The\nearly probe exits should not call a common teardown path that assumes the\nlater work setup has already completed.\n\nA QEMU PoC forced alloc_ordered_workqueue() to fail before the work\ninitializers are reached. The resulting fail path entered\nrt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with\nrt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.(CVE-2026-72005)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc-\u0026gt;tx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid \u0026gt;= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index.(CVE-2026-74408)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n\u0026apos;aligned * cpp\u0026apos; calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry.(CVE-2026-74417)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear new_transport when removing a peer\n\nsctp_process_asconf_param() stores a newly added peer transport in\nasoc-\u0026gt;new_transport. After all parameters in the ASCONF chunk have been\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the\nnew transport.\n\nAn authenticated ASCONF from a remote SCTP peer can add a transport and\nremove it again with a wildcard DEL-IP parameter in the same chunk. The\nwildcard deletion preserves the transport on which the ASCONF arrived, but\nremoves the newly added transport through\nsctp_assoc_del_nonprimary_peers(). The removal does not clear\nasoc-\u0026gt;new_transport, leaving it pointing to the removed transport.\n\nsctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u0026gt;transport points\nto the removed transport without holding a transport reference. During\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on\ncontrol_chunk_list. After the transport is freed by RCU, a successful\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and\nsctp_outq_select_transport() reads the freed transport\u0026apos;s state.\n\nThe issue was found during a static audit of SCTP objects. With an\nauthenticated peer, the reproducer triggered the same KASAN report in 2\nof 2 unpatched runs on a KASAN-enabled netdev/main kernel:\n\n  BUG: KASAN: slab-use-after-free in sctp_outq_select_transport\n  Read of size 4 at addr ffff88800b9bd95c by task python3/197\n\n  Call Trace:\n   sctp_outq_select_transport+0x549/0x8b0 [sctp]\n   sctp_outq_flush+0x306/0x2c60 [sctp]\n   sctp_transport_immediate_rtx+0xaf/0x260 [sctp]\n   sctp_process_asconf_ack+0xa48/0xf70 [sctp]\n\n  Allocated by task 197:\n   sctp_transport_new+0x68/0x650 [sctp]\n   sctp_assoc_add_peer+0x258/0x12a0 [sctp]\n   sctp_process_asconf+0x5e9/0x1090 [sctp]\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x77/0xb70\n   sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]\n   sctp_process_asconf+0xd9c/0x1090 [sctp]\n\nThe first invalid access was a four-byte read of transport-\u0026gt;state at\nnet/sctp/outqueue.c:833. The same reproducer completed the full\nauthenticated ASCONF and local-address replacement sequence with this\nchange without a KASAN report or oops.\n\nClear new_transport when its peer is removed, before it can be used to\ncreate the HEARTBEAT.(CVE-2026-74586)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: Shut down rtpoll_timer in psi_cgroup_free()\n\npsi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath\nand can race psi_trigger_destroy() taking down the last rtpoll trigger under\nrtpoll_trigger_lock:\n\n  psi_schedule_rtpoll_work()        psi_trigger_destroy()\n\n  rcu_read_lock();\n  task = rcu_dereference(rtpoll_task);\n                                    rcu_assign_pointer(rtpoll_task, NULL);\n                                    timer_delete(\u0026amp;rtpoll_timer);\n  mod_timer(\u0026amp;rtpoll_timer, ...);\n  rcu_read_unlock();\n                                    synchronize_rcu();\n                                    kthread_stop(task_to_destroy);\n\nThe group can then be freed with the re-armed timer still pending, and\npoll_timer_fn() runs on freed memory.\n\n461daba06bdc (\u0026quot;psi: eliminate kthread_worker from psi trigger scheduling\nmechanism\u0026quot;) deleted the timer synchronously after the synchronize_rcu(),\nwhich prevented this but raced trigger creation instead: the deletion could\ncancel the timer that a new trigger set armed during the grace period and,\nas creation also reinitialized the timer at the time, corrupt it.\n8f91efd870ea (\u0026quot;psi: Fix race between psi_trigger_create/destroy\u0026quot;) moved the\ninitialization into group_init() and the deletion into the locked section,\ntrading the creation races for the window above.\n\nNeither placement in the destruction path works. A pending timer firing\nwhile the group is alive is harmless though. poll_timer_fn() just wakes the\nrtpoll waitqueue and doesn\u0026apos;t re-arm itself. Bind the timer to the group\u0026apos;s\nlifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it\nby then. timer_shutdown_sync() because the timer is never armed again.(CVE-2026-74594)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u0026gt;link under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u0026gt;lock:\n\n\tstruct tipc_link *l = le-\u0026gt;link;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u0026gt;link = NULL;\n\nThe delete=true caller frees that very object under n-\u0026gt;lock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u0026gt;lock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u0026gt; bearer_disable()\n   -\u0026gt; tipc_node_delete_links() -\u0026gt; tipc_node_link_down(n, bearer_id, true)\n   -\u0026gt; kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u0026gt;link read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.(CVE-2026-74609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in TX_RING send path\n\ntpacket_snd() reads dev-\u0026gt;hard_header_len independently for skb\nallocation and header construction in tpacket_fill_skb(). Concurrent\nnetdevice reconfiguration can therefore make the reserved headroom\nsmaller than the amount later pushed, or make copylen - hard_header_len\nnegative.\n\nSnapshot hard_header_len once before processing ring frames and use it\nfor the frame limit, headroom allocation, copy length, and skb\nconstruction. Pass the snapshot to tpacket_fill_skb().\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u0026gt;create is not addressed here.(CVE-2026-74668)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk-\u0026gt;transport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list.  The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk-\u0026gt;transport for queued control chunks in\ncontrol_chunk_list when removing the transport.(CVE-2026-74688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Implement a crw lock\n\nUnlike the channel_program struct, which covers synchronous I/O\nsubmissions and asynchronous interrupts, the CRW region relies\nexclusively on asynchronous events coming from hardware.\n\nImplement a lock to manage the list of those payloads, to ensure\nthey are read cohesively.(CVE-2026-80547)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Selectively expand io_mutex\n\nThe io_mutex was defined to serialize the io_regions, but then has\nalso sort of been associated with the I/O themselves because of\nthe close relationship they share.\n\nWith the handful of races that are possible, the choices are either to:\n A) expand the scope of io_mutex to close these remaining windows, or\n B) reduce the scope of io_mutex to just io_region, and introduce a new\n    lock mechanism for the remaining I/O resources\n\nThis patch implements A, since B brings with it a lot more interactions\nthat would need to be tracked and kept in a correct hierarchy. It also\ntakes advantage of the workqueue element for cp_free() that now gets\ncalled out of fsm_notoper(), which could be invoked out of an interrupt\ncontext and thus cannot acquire a mutex itself.(CVE-2026-80548)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Ensure first IDAW remains constant\n\nThe first IDAW in a list does not need to be on a 2K/4K boundary\nlike all others, and so is read separately to accurately calculate\nthe size of the buffer needed to read the full IDAL.\n\nVerify that the address found in the first IDAW is unchanged between\nreads, to ensure a consistent set of IDAWs being worked with.(CVE-2026-80551)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Limit the number of channel program segments\n\nThe processing of channel programs, and the CCWs within them, is done\nrecursively. As such, there is an arbitrary (but not architectural)\nlimit to the number of CCWs that can exist in a single channel program.\n\nThe vfio-ccw logic breaks these channel programs into segments whenever\nit encounters a Transfer-In-Channel (TIC) CCW, and the combined number\nof segments count towards the global limit. Impose an equivalent limit\nto the number of segments until such logic can be made non-recursive.(CVE-2026-80554)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix F55 transmitter electrode count typo\n\nDuring F55 sensor detection, the transmitter (TX) electrode count was\nincorrectly assigned the value of the receiver (RX) electrode count\ndue to copy-paste typos.\n\nThis incorrect value was then propagated to the driver data and used\nby F54 to determine the diagnostics report size. On devices with more\nRX than TX electrodes, this inflated the perceived TX count, leading\nto incorrect report size calculations and potential out-of-bounds\nbuffer accesses.\n\nFix the typos by correctly assigning the TX electrode counts.(CVE-2026-80754)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: validate attr entry pointer before field access\n\nxfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,\nvaluelen) before checking if the entry pointer itself is within bounds.\nIf nameidx is crafted to point near the end of the buffer, these field\naccesses can read out-of-bounds before the bounds check at\nname_end \u0026gt; buf_end is performed.\n\nAdd explicit bounds checks for entry pointers before accessing their\nfields. Use offsetof() to check that the start of the flexible array\nmember (nameval/name) is within bounds, which ensures all preceding\nfields are safe to access.(CVE-2026-80805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0026apos;t enable DAX on new encrypted files\n\nCurrently, when a new encrypted regular file is created, the call to\next4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made\nbefore EXT4_INODE_ENCRYPT is set.  As a result, it can set S_DAX if the\nfilesystem is mounted with \u0026quot;-o dax=always\u0026quot;.\n\nEXT4_INODE_ENCRYPT then actually gets set a bit later in\n__ext4_new_inode(), when it calls fscrypt_set_context() which calls\next4_set_context().  ext4_set_context() sets EXT4_INODE_ENCRYPT and\ncalls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too.\n\nThis was intended to clear S_DAX as well.  However, this was broken by\ncommit 043546e46dc7 (\u0026quot;fs/ext4: Only change S_DAX on inode load\u0026quot;).  This\ncauses data written to the file to bypass encryption, also causing\nxfstests failures such as generic/548 (when \u0026quot;-o dax=always\u0026quot; is used).\n\nFix this by simplifying the flow by making __ext4_new_inode() set\nEXT4_INODE_ENCRYPT earlier.  This makes it take effect in\next4_set_inode_flags(inode, init=true), making S_DAX never be set.\n\nSimilarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first\nplace on new encrypted inodes.  Then it doesn\u0026apos;t need to be cleared.\n\nAs a result of these simplifications, ext4_set_context() no longer needs\nto change inode flags or state when \u0026apos;handle != NULL\u0026apos;.  Remove that too.(CVE-2026-80806)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: keep port count until LUN teardown completes\n\ntcm_usbg_drop_nexus() permits session removal once tpg_port_count\nreaches zero. However, usbg_port_unlink() currently decrements that\ncount from the fabric_pre_unlink() callback, before core_dev_del_lun()\nwaits for active se_lun references to drain.\n\nIf removal of the last LUN races a nexus removal, the latter can observe\na zero port count and call target_remove_session(). This frees\nsess_cmd_map while an in-flight struct usbg_cmd, including its work item,\ncan still be accessed.\n\nOverlapping the last-LUN unlink with nexus removal reproduces this\nlifetime violation as a DEBUG_OBJECTS \u0026quot;free active\u0026quot; warning for\nusbg_cmd_work, followed by a target-core BUG/Oops.\n\nThe generic target-core unlink path has no callback after\ncore_dev_del_lun() completes. Add an optional fabric_post_unlink()\ncallback and use it for the f_tcm port count. The count now remains\nnonzero until core_dev_del_lun() has finished draining active LUN\nreferences, preventing nexus removal from freeing the session during\ncommand completion.(CVE-2026-80854)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits.(CVE-2026-80921)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: do not dereference an unset send buffer on the SMC-D teardown path\n\nsmc_close_stream_wait() calls smc_tx_prepared_sends() from inside its\nsk_wait_event() condition, and sk_wait_event() evaluates that condition\nonce with the socket lock released. smcd_buf_detach() clears\nconn-\u0026gt;sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group\nterminating while a socket waits there leaves the helper dereferencing\nNULL, faulting out of close(). SIOCOUTQ reads the field by hand, and\nsmc_close_cancel_work() drops the lock across two cancel_*_sync() calls.\n\nSample the pointer once in the helper, report nothing prepared while it is\nunset, and bound the ioctl the same way. The receive tasklet dereferences\nthe field directly in smc_cdc_msg_recv_action(), not through this helper;\n1/2 is what keeps it from running that late.(CVE-2026-80984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Mark the connection down when bringing it up fails\n\nEvery failure path in tbnet_connected_work() undoes its own work and\nreturns without clearing login_sent, so the connection still looks\nestablished. The next tbnet_tear_down() therefore takes its main branch\nand repeats a teardown that already happened: it stops rings that are\nalready stopped, which is a dev_WARN() and fatal under panic_on_warn,\nand it releases net-\u0026gt;remote_transmit_path even on the HopID mismatch\npath, where this connection never owned that id, silently freeing one\nthat someone else is still using.\n\nClear login_sent on those paths. That is enough for tbnet_tear_down() to\nleave the unwound state alone, and login_received has to stay set: it\nrecords that the peer has logged in and carries the transmit path it gave\nus, which nothing on this side can make the peer send again. Two things\nchange beyond keeping the teardown out of the way: the logout request in\nthat block is no longer sent, and the peer\u0026apos;s next login request now\nre-queues our login work rather than connected_work, giving the\nconnection a fresh login instead of a retry on stale state.(CVE-2026-80989)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix flow mask use-after-free on flow deletion\n\nThe commit in the Fixes tag below made so flow-\u0026gt;mask free is scheduled\nvia RCU right after it is removed from the flow table.  The pointer\nstays in the flow structure and it can be accessible while in the same\nRCU critical section.  This is done to avoid requiring ovs_mutex for\nthe ovs_flow_free().\n\nHowever, while removing the flow during processing of CMD_DEL, we do\nnot take RCU read lock before the removal, and ovs_flow_cmd_fill_info()\nuses the flow-\u0026gt;mask pointer afterwards.  The RCU read lock is taken,\nbut it\u0026apos;s already late at that point.  The comment on that line\nacknowledges that the lock is cosmetic and doesn\u0026apos;t serve a real purpose.\n\nThis leads to use-after-free if the RCU grace period passes between\nremoval and the filling.  It is a short race window, but it is there\nand can lead to a real crash in case memory allocation for the info\ntakes a bit longer:\n\n BUG: KASAN: slab-use-after-free in __ovs_nla_put_key\n             net/openvswitch/flow_netlink.c:1996\n BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30\n             net/openvswitch/flow_netlink.c:2250\n Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487\n\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996\n  ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250\n  ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930\n  ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467\n  ...\n  netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 9487:\n  mask_alloc net/openvswitch/flow_table.c:967\n  flow_mask_insert net/openvswitch/flow_table.c:1012\n  ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084\n  ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086\n  ...\n  netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556\n\n Freed by task 9485:\n  rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978\n  rcu_do_batch kernel/rcu/tree.c:2645\n  rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897\n  handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622\n  ...\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062\n\novs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info()\nto avoid this race.  This also helps with cleaning up the forced cast\nand the cosmetic RCU read lock.  Before the commit in the Fixes tag the\norder did not matter as long as the flow object itself was not freed.\n\nA wider RCU critical section could be another option, but we have a\nGFP_KERNEL allocation in the way.\n\nReported by Trend Micro\u0026apos;s Zero Day Initiative as ZDI-CAN-32042.(CVE-2026-80994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: stop card-detect handling on probe failure\n\nrequest_irq() registers the SD card-detect interrupt and the probe enables\nit before mmc_add_host() runs. If mmc_add_host() fails, the error path only\nunmaps the registers and returns: the interrupt stays registered, so the\nhandler keeps running against the host once it is freed. via_sdc_isr()\ndereferences sdhost and its MMIO base and schedules carddet_work, which\nvia_sdc_card_detect() also runs against freed memory through its\ncontainer_of() dereference.\n\nAdd a probe-error path that disables and frees the interrupt and cancels\ncarddet_work before unmapping. carddet_work can re-enable the device\ninterrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it\nagain after cancelling the work.\n\nThis issue was found by an in-house static analysis tool and confirmed by\nmanual code review.(CVE-2026-89440)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix NULL deref on untransmitted RECONF completion\n\nsctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and\nsctp_process_strreset_resp() complete a pending stream reconfiguration\nrequest by stopping the reconf timer on the transport it was sent on:\n\n\tt = asoc-\u0026gt;strreset_chunk-\u0026gt;transport;\n\tif (timer_delete(\u0026amp;t-\u0026gt;reconf_timer))\n\t\tsctp_transport_put(t);\n\nchunk-\u0026gt;transport is assigned by __sctp_packet_append_chunk() when the\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms\nthe reconf timer at that same point. A request already published in\nasoc-\u0026gt;strreset_chunk but not yet transmitted has neither, so completing\nit dereferences NULL.\n\nTwo ways to get there. sctp_send_asconf_del_ip() sets\nasoc-\u0026gt;src_out_of_asoc_ok without sending anything when the address being\nremoved is the association\u0026apos;s last one, and sctp_outq_flush_ctrl() then\nleaves every non-ASCONF control chunk queued; as only\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged\nprocess that removes such an address and then asks for a stream reset\npanics the kernel from softirq. A peer needs neither ASCONF nor local\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole\npacket has been processed, so a reply built while walking a RECONF chunk\nstays untransmitted for the rest of that walk, and one RECONF chunk\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,\nResponse] -- or two RECONF chunks in one packet -- reaches the same\ndereference.\n\n  KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]\n  RIP: 0010:timer_delete+0x67/0x110\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)\n   sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)\n   sctp_do_sm (net/sctp/sm_sideeffect.c:1172)\n   sctp_assoc_bh_rcv (net/sctp/associola.c:1044)\n   sctp_rcv (net/sctp/input.c:243)\n   ip_local_deliver (net/ipv4/ip_input.c:262)\n   process_backlog (net/core/dev.c:6680)\n   \u0026lt;/IRQ\u0026gt;\n\nA response can only acknowledge a request that was actually sent, so do\nnot match asoc-\u0026gt;strreset_chunk while chunk-\u0026gt;transport is NULL. Guarding\nthe lookup covers all three completion sites.(CVE-2026-89477)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: reject a read that transferred too few bytes\n\nnvme_tcp_recv_data() completes a request once the current C2HData PDU\nhas been consumed. Nothing compares the total bytes received against\nthe length the command asked for: struct nvme_tcp_request has no\nreceive-side counter, queue-\u0026gt;data_remaining is per queue, and\nblk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally\nwith no residual concept anywhere above.\n\nA controller can therefore answer a 4096-byte read with 512 bytes and\nhave it reported as a complete read; user space then gets 4096 bytes of\nwhich 3584 are whatever was already in the page. I reproduced that with\na test target.\n\nCount the bytes received and refuse to complete a successful read whose\ncount does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in\nnvme_tcp_process_nvme_cqe(). The success test shifts req-\u0026gt;status right\nby one, because the driver keeps the wire value there and shifts it on\ncompletion, so the check must see what the completion path will see.\nOnly REQ_OP_READ is checked, because there the length comes from the\nsectors the request covers; a passthrough command is built by its\nsubmitter, which picks both command and buffer, so the kernel has\nnothing to compare against.(CVE-2026-89480)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request\u0026apos;s data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write.(CVE-2026-89481)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlockd: pin next file across nlm_inspect_file lock-drop\n\nnlm_traverse_files() pins the current file with f_count++ across\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\nnext pointer.  A concurrent nlm_release_file() can kfree the next\nfile during the unlock window, and the iterator dereferences freed\nmemory on the next loop step.\n\nPin both current and next before the lock-drop.  Advance by\nswapping the pinned cursors at the end of each iteration so next\nis always held alive across the unlock.\n\nAlways call nlm_file_release() after dropping the iteration pin,\nregardless of whether the file matched the predicate.  Use\nnlm_file_inuse(), which does a live walk of the inode lock list,\nrather than the cached f_locks field, so skipped files that never\nran nlm_inspect_file() are evaluated correctly.\n\nBecause every file in a hash bucket is now pinned and released,\nfiles skipped by the is_failover_file predicate that have no\nlocks, blocks, shares, or external references are deleted during\ntraversal.  The old code never evaluated skipped files for\ncleanup.  The new behavior is intentional: such files are stale\nand should not persist in the table.(CVE-2026-89485)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow\u0026apos;s remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u0026gt;flags \u0026amp;= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()\u0026apos;s kerneldoc\nsays \u0026quot;skb must be freed afterwards\u0026quot;).\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\u0026quot;Fragnesia\u0026quot; primitive).\ndo_execute_actions() ignores output_userspace()\u0026apos;s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \u0026quot;default\u0026quot;\nbranch of ovs_dp_process_packet()\u0026apos;s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\u0026quot;core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\u0026quot;) but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.(CVE-2026-89487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate directory-index entry counts when reading metadata\n\nocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and\nsignature of an indexed-directory block before it reaches higher-level\ncallers, but neither validator bounds the ocfs2_dx_entry_list counts\nagainst the capacity of the block that holds them.\n\nocfs2_dx_dir_search() then walks\n\n\tfor (i = 0; i \u0026lt; le16_to_cpu(entry_list-\u0026gt;de_num_used); i++)\n\t\tdx_entry = \u0026amp;entry_list-\u0026gt;de_entries[i];\n\nover de_num_used entries with no bounds check.  entry_list is either\ndx_leaf-\u0026gt;dl_list (from ocfs2_read_dx_leaf) or, for an inline root,\ndx_root-\u0026gt;dr_entries.  A crafted on-disk image can set de_num_used (and\nde_count, which is the __counted_by_le() bound of de_entries) to 0xffff\nand make the walk read far past the end of the 4KB metadata block, giving\na slab out-of-bounds read reachable from any path lookup, stat() or open()\non an indexed directory once the image is mounted.\n\nCommit 775c17386a6f (\u0026quot;ocfs2: validate dx_root extent list fields during\nblock read\u0026quot;) already bounds dr_list for the non-inline dx_root, but left\nthe inline dr_entries path and the dx_leaf dl_list unchecked.  Add the\nsame read-time validation for both entry lists: de_count must equal the\ncapacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and\nde_num_used must not exceed de_count, rejecting corrupted metadata with\n-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry\narray.\n\nde_count is always written as exactly the block capacity when a leaf or\ninline root is formatted, so the equality check does not reject any valid\nimage.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).(CVE-2026-89492)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\u0026quot;qede: Add build_skb() support.\u0026quot;) accidentally\ndropped the assignment of tpa_info-\u0026gt;buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\u0026quot;ghost\u0026quot; BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n   qede_rx_int+0xb06/0x1de0\n   qede_poll+0x2f4/0x6c0\n   __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info-\u0026gt;buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage.(CVE-2026-89511)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naudit: avoid dropping live tree ref on fsnotify rule autoremove\n\naudit_del_rule() is used for both netlink deletion templates and internal\nfsnotify autoremove.  The former passes a parsed template which owns a\ntemporary tree reference; the latter passes the installed entry itself.\n\nThe unconditional audit_put_tree() at the end of audit_del_rule() assumes\nthe template case.  For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify\nautoremove event therefore drops the installed rule\u0026apos;s live tree reference.\nRepeating this across rules sharing the same tree can free the tree while\nanother rule still references it, and a later autoremove dereferences the\nfreed pathname while comparing rules.\n\nMove the temporary-tree put to audit_rule_change(), the caller that owns\ndeletion templates.  Keep it in the AUDIT_DEL_RULE cleanup so both\nsuccessful deletion and -ENOENT still release the parser-owned tree.\n\n[PM: dropped unnecessary comment for line length reasons](CVE-2026-89643)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid\u0026apos;s sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader\u0026apos;s nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n  - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n    _free_cpntf_state_locked() on the first list entry; a holder that had\n    bumped cs_count made it return early, so the next iteration\n    re-decremented and burned the holder\u0026apos;s reference.\n\n  - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n    used _free_cpntf_state_locked() and could drop 2-\u0026gt;1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(\u0026amp;cps-\u0026gt;cp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op).(CVE-2026-89663)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp-\u0026gt;mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp-\u0026gt;acl_access\nonly when NFS_ACL is set in the request mask and argp-\u0026gt;acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\u0026quot;remove this ACL type\u0026quot; operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory\u0026apos;s default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms.(CVE-2026-89672)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n\u0026amp;u-\u0026gt;copy-\u0026gt;cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result-\u0026gt;cb_stateid is unchanged.(CVE-2026-89676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: validate symlink target length in NFSv4 CREATE\n\nnfsd4_decode_create() accepts an unbounded cr_datalen from the wire for\nNF4LNK symlink targets, allowing a client to force a kmalloc of up to\nthe maximum RPC payload size (several MiB) per COMPOUND op that persists\nuntil compound teardown.  The VFS rejects oversized targets with\nENAMETOOLONG, but the allocation has already occurred.\n\nReject cr_datalen == 0 early with nfserr_inval and cr_datalen greater\nthan NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the\nallocation.(CVE-2026-89699)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check\n\nThe header for commit e75b23f9e323 (\u0026quot;nfsd: check d_can_lookup in\nfh_verify of directories\u0026quot;) details the assumption that justified\nadding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is\ninvalid (in the case of NFS reexport).\n\nWhen NFSD exports an NFS filesystem it is very possible for\nnfsd_mode_check() to encounter a @dentry that doesn\u0026apos;t have\ni_op-\u0026gt;lookup (see nfs_fhget()\u0026apos;s NFS_ATTR_FATTR_MOUNTPOINT and\nNFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).\n\nSo remove nfsd_mode_check()\u0026apos;s WARN_ON_ONCE(). The nfserr_notdir\nreturn on that branch must stay. It guards the subsequent\nlookup_one_unlocked() -\u0026gt; __lookup_slow() path, which calls\ninode-\u0026gt;i_op-\u0026gt;lookup() with no NULL check, so returning nfserr_notdir\nis what keeps a client LOOKUP into such a @dentry from dereferencing\na NULL method pointer.(CVE-2026-89711)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u0026gt;i_size load.(CVE-2026-89713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n\nsensor_hub_get_feature() clamps its return value to the caller\u0026apos;s buffer\nsize, but the copy loop still copies field-\u0026gt;report_size / 8 bytes for\neach report value. A malicious HID descriptor can advertise a large\nfeature field size while an IIO caller supplies a small stack buffer,\nsuch as a single s32, causing an out-of-bounds write.\n\nHID core stores parsed report values in __s32 slots and clamps extracted\nvalues to 32 bits. Reject feature fields that require more than one slot\nper value, guard the total byte count calculation, and clamp each\nper-value copy to the remaining caller buffer.(CVE-2026-89729)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: fix user path of nested backing files\n\nbacking_file_open() derives the path to be stored in the new backing\nfile from user_file-\u0026gt;f_path.  This is incorrect when user_file itself\nis a backing file, which is the case for nested stacking filesystems,\ne.g. overlayfs mounts where the lowerdir of one overlayfs is the merged\ndirectory of another.  Since commit def3ae83da02 (\u0026quot;fs: store real path\ninstead of fake path in backing file f_path\u0026quot;) the f_path of a backing\nfile holds the real path of the intermediate layer, not the path that\nthe user opened.\n\nCommit 924577e4f6ca (\u0026quot;ovl: Fix nested backing file paths\u0026quot;) fixed this\nfor such configurations by passing file_user_path() from\novl_open_realfile().  However, commit 6af36aeb147a (\u0026quot;lsm: add\nbacking_file LSM hooks\u0026quot;) changed the first argument of\nbacking_file_open() from the user path back to the user file and\nderived the path from user_file-\u0026gt;f_path again, silently re-introducing\nthe problem.\n\nAs a result, files mapped through a nested overlayfs show the wrong\npath in /proc/\u0026lt;pid\u0026gt;/maps and in perf/ftrace mmap records.  For example,\nwith two nested overlayfs mounts:\n\n  mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested\n  echo hello \u0026gt; /ovl/lower/foo\n  mount -t overlay overlay \\\n\t-o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \\\n\t/ovl/merged\n  # at least two lowerdirs are needed when upperdir is nonexistent\n  mount -t overlay overlay \\\n\t-o lowerdir=/ovl/merged:/ovl/lower /ovl/nested\n\nmapping /ovl/nested/foo shows a disconnected path instead of the user\npath:\n\n  # readlink /proc/self/fd/3\n  /ovl/nested/foo\n  # grep foo /proc/self/maps\n  7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo\n\nThe bogus path is derived from the f_path of the intermediate backing\nfile, whose mount is a private clone that d_path() cannot resolve.\n\nFix this by using file_user_path(), which returns the outermost\nuser-visible path for backing files and falls back to\n\u0026amp;user_file-\u0026gt;f_path for regular files.  This restores the behavior of\ncommit 924577e4f6ca (\u0026quot;ovl: Fix nested backing file paths\u0026quot;) for\noverlayfs and also fixes the same problem for the other\nbacking_file_open() callers, fuse passthrough and erofs ishare, when\ntheir user file is itself a backing file.\n\nbacking_tmpfile_open() has the same pattern but is not affected: it is\nonly called by ovl_create_tmpfile() for the upper layer, and another\noverlayfs is rejected as upperdir by the DCACHE_OP_REAL check in\novl_mount_dir_check(), so its user_file can never be a backing file.(CVE-2026-89768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()\u0026apos;s empty-block fast path returns\npcount \u0026lt;\u0026lt; PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\u0026quot;if (poffset \u0026amp;\u0026amp; *pages)\u0026quot; reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift \u0026gt; 17, so a crafted \u0026quot;ZF\u0026quot; Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache(CVE-2026-89778)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm: fix race between partial drm_dev_register() failure and ioctl\n\nIf drm_dev_register() fails after registering a minor (e.g. render minor\nregistered, primary minor fails), userspace could have opened the first\nminor and entered a drm_dev_enter() critical section. Since the\nunplugged flag was never set, the ioctl proceeds while the error path\ntears down device resources.\n\nFix this by introducing drm_dev_synchronize_unplug(), which sets the\nunplugged flag and waits for the SRCU barrier, ensuring all in-flight\ndrm_dev_enter() critical sections complete before cleanup proceeds; call\nit on the error path of drm_dev_register().(CVE-2026-89823)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix cs84xx use-after-free on host teardown\n\nqla84xx_put_chip() drops the last reference to ha-\u0026gt;cs84xx and frees it via\n__qla84xx_chip_release() without clearing ha-\u0026gt;cs84xx. During teardown it ran\nbefore scsi_remove_host(), which is what removes the 84xx_fw_version host\nsysfs attribute. A concurrent read of that attribute in the window between\nthe two calls executes qla24xx_84xx_fw_version_show(), which dereferences\nthe freed ha-\u0026gt;cs84xx, resulting in a use-after-free.\n\nMove qla84xx_put_chip() to after scsi_remove_host() in both\nqla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once\nscsi_remove_host() returns, the sysfs attribute is gone and kernfs has\ndrained any in-flight show(), so no reader can touch cs84xx; the put still\nruns before the host and ha are freed.(CVE-2026-89854)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation\n\nha-\u0026gt;msix_count is u16, but ha-\u0026gt;max_req_queues, ha-\u0026gt;max_rsp_queues and\nha-\u0026gt;max_qpairs are u8. Deriving the queue count as\n\u0026quot;ha-\u0026gt;max_req_queues = ha-\u0026gt;msix_count - 1\u0026quot; therefore truncates: a board\n(or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X\nvectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X\ncount of 1 zeroes it as well, and in target mode the subsequent\n\u0026quot;ha-\u0026gt;max_req_queues--\u0026quot; then underflows 0 to 255.\n\nWhen the count is 0, qla2x00_alloc_queues() calls\nkzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is\nnot NULL, so the allocation check passes and the following\n\u0026quot;ha-\u0026gt;req_q_map[0] = req\u0026quot; dereferences ZERO_SIZE_PTR, corrupting memory\nor crashing the kernel.\n\nAdd qla_calc_queue_count() to clamp the derived value into\n[1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and\nuse it at all three derivation sites (qla25xx_iospace_config(),\nqla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the\ntarget-mode decrement so it cannot reintroduce a zero (which would in\nturn underflow max_qpairs).(CVE-2026-89856)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n\nIn the format 1 path, the virtual port is located on ha-\u0026gt;vp_list while\nholding vport_slock, but the lock is dropped before vp is used:\nqla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport\ndown and free it, leading to a use-after-free.\n\nTake a vport reference (vref_count) under vport_slock when the matching\nvp is found, and drop it after the last use of\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before\nunlinking and freeing the vport, so the pointer stays valid. This\nmatches the reference idiom already used by the other ha-\u0026gt;vp_list\ntraversals.(CVE-2026-89861)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix memory corruption by not reinjecting CK machine checks\n\nChannel-subsystem damage machine checks are for the host channel\nsubsystem. The guest channel subsystem is emulated in the userspace VMM.\nThere is no point in forwarding such machine checks into the guest.\n\nThis also simplifies the machine check reinjection and avoids kfree of a\nstack variable as reported by sashiko.  There might be still machine\nchecks that have the ck bit set with another bit (like instruction\ndamage), mask out the CK bit in s390_backup_mcck_info(), like the CP and\nED bits already are.(CVE-2026-89920)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: hyper-v: Clamp stimer deadline to avoid livelock\n\nFix an issue where userspace or the guest can program an Hyper-V\nsynthetic timer to have a deadline in the past via integer overflow,\npreventing the CPU from making progress and triggering an RCU stall.\n\nHyper-V\u0026apos;s SynIC exposes 4 per-vCPU synthetic timers to the\nguest, which are emulated by KVM. Each is programmed through the\nHV_X64_MSR_STIMERi_CONFIG and HV_X64_MSR_STIMERi_COUNT MSRs. Depending\non CONFIG, COUNT represents either the absolute expiration time or the\nperiod of a periodic timer, both expressed in 100ns ticks. These timers\nmay be set both by the guest (WRMSR) and the host (KVM_SET_MSRS).\n\nWhen the timer is enabled, stimer_start() translates COUNT to an\nabsolute monotonic deadline and arms an hrtimer. If COUNT is set to a\nvalue close to U64_MAX, the deadline calculation can overflow.\n\n    ktime_add_ns(ktime_now, 100 * (stimer-\u0026gt;exp_time - time_now))\n\nThis can result in a CPU livelock. stimer_start() arms the timer\nvia hrtimer_start() with a deadline in the past, which causes it to\nimmediately fire. The stimer callback then raises KVM_RQ_HV_STIMER, with\nthe intention of causing KVM to deliver a synthetic interrupt on the\nnext vCPU guest enter.\n\nThen, once userspace issues KVM_RUN, vcpu_enter_guest() consumes the\nrequest, calling kvm_hv_process_stimers(). This would normally disable\nthe timer via stimer_expiration() once the deadline is in the past.\nHowever, the deadline comparison is done between the KVM reference\ncounter and stime-\u0026gt;exp_time, which is a big value close to U64_MAX, so\nthis never happens for a few thousand years.\n\nkvm_hv_process_timers() then re-arms the timer via stimer_start(), since\nit was not disabled, which again fires immediately. Before entering\nthe guest, kvm_vcpu_exit_request() checks kvm_request_pending(),\nwhich returns true due to the newly raised KVM_REQ_HV_STIMER. Then\nvcpu_enter_guest() aborts the guest entry, returning early into\nvcpu_run(), which loops back again into vcpu_enter_guest(), restarting\nthe cycle.\n\nSince there are no manual yields in this loop, a task with SCHED_FIFO\nmay starve RCU grace-period kthreads, which exposes the stalls found\nby syzcaller:\n\n    rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n    rcu:    (detected by 1, t=10502 jiffies, g=14269, q=1142 ncpus=2)\n    rcu: All QSes seen, last rcu_preempt kthread activity 10500 (4294965239-4294954739), jiffies_till_next_fqs=1, root -\u0026gt;qsmask 0x0\n    rcu: rcu_preempt kthread starved for 10500 jiffies! g14269 f0x2 RCU_GP_WAIT_FQS(5) -\u0026gt;state=0x0 -\u0026gt;cpu=0\n    rcu:    Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.\n        ( ... )\n    Call Trace:\n     \u0026lt;IRQ\u0026gt;\n     __run_hrtimer kernel/time/hrtimer.c:1773 [inline]\n     __hrtimer_run_queues+0x408/0xc30 kernel/time/hrtimer.c:1841\n     hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903\n     local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]\n     __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062\n     instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]\n     sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056\n     \u0026lt;/IRQ\u0026gt;\n     \u0026lt;TASK\u0026gt;\n     asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697\n    RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]\n    RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194\n    Code: 74 05 e8 0b f4 5f f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 \u0026lt;e8\u0026gt; 23 6b 27 f6 65 8b 05 7c 60 5a 07 85 c0 74 40 48 c7 04 24 0e 36\n    RSP: 0018:ffffc900040a7320 EFLAGS: 00000206\n    RAX: 5de15cb931505900 RBX: 0000000000000a06 RCX: 5de15cb931505900\n    RDX: 0000000000000007 RSI: ffffffff8daa9dc3 RDI: 0000000000000001\n    RBP: ffffc900040a73b0 R08: ffffffff8fc3d0\n---truncated---(CVE-2026-89927)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02.  nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u0026gt; VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU.(CVE-2026-89932)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block\u0026apos;s nfree field, the number of reserve free blocks, is\nread from the medium without validation.  btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region-\u0026gt;num_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree.  Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant.(CVE-2026-89965)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: check the data direction of a C2HData PDU\n\nnvme_tcp_handle_c2h_data() finds the request by command id and checks\nthat it has a payload, but it does not check that the command asked for\ndata to be read.  A controller that answers a write command with C2HData\ntherefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits\nWARN_ON_ONCE(i-\u0026gt;data_source) and returns 0.  The receive path turns that\ninto -EFAULT and resets the controller.\n\nNo data is copied, so this is not memory corruption.  What a controller\ngets is a kernel warning it can raise at will, which is fatal on a host\nbooted with panic_on_warn.\n\nThe send path already knows the direction - it consults rq_data_dir()\nwhen it builds a command - and nvme_tcp_handle_r2t() checks the length\nand the offset of the request it names.  The C2HData path does not check\nthe direction at all.\n\nReject a C2HData PDU whose command is not a read.  Rejecting it fails\nthe command and resets the controller, as the neighbouring check in this\nfunction does; what goes away is the warning.\n\n  [    6.885580] ------------[ cut here ]------------\n  [    6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71\n  [    6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)\n  [    6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work\n  [    6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330\n  [    6.903739] Call Trace:\n  [    6.904085]  \u0026lt;TASK\u0026gt;\n  [    6.909254]  __skb_datagram_iter+0x433/0x820\n  [    6.911026]  skb_copy_datagram_iter+0x37/0x120\n  [    6.911622]  nvme_tcp_recv_skb+0xa07/0x4320\n  [    6.913378]  __tcp_read_sock+0x1ab/0x810\n  [    6.915788]  nvme_tcp_try_recv+0x152/0x1e0\n  [    6.918222]  nvme_tcp_io_work+0x1e4/0x6c0\n  [    6.926906]  \u0026lt;/TASK\u0026gt;\n  [    6.927226] ---[ end trace 0000000000000000 ]---\n  [    6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data\n  [    6.928709] nvme nvme0: receive failed:  -14(CVE-2026-89973)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: return struct page from dma_direct_alloc_from_pool()\n\nCommit 5b138c534fda (\u0026quot;dma-direct: factor out a dma_direct_alloc_from_pool\nhelper\u0026quot;) changed dma_direct_alloc_from_pool() to return the CPU address\nfrom dma_alloc_from_pool(). That fits dma_direct_alloc(), but\ndma_direct_alloc_pages() also uses the helper and expects a struct page *.\n\nFix this by making dma_direct_alloc_from_pool() return the struct page *\nagain, and pass the CPU address back through an out-parameter for the\ndma_direct_alloc() caller.(CVE-2026-89995)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix OOB altmode array index\n\nThe UCSI displayport driver indexes the connector\u0026apos;s port altmode array\nwith the GET_CURRENT_CAM response after checking it is not 0xff. The\nport altmode array is UCSI_MAX_ALTMODES elements long. If the PPM\nreturns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and\nnot equal to 0xff, the kernel may crash with an array index OOB error.\n\nUpdate the UCSI displayport driver to verify the current cam is less\nthan UCSI_MAX_ALTMODES before accessing the port altmode array.(CVE-2026-90025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pnfs: key the data server cache on the NFS version\n\nnfs4_pnfs_ds_add() keys the per-net data server cache on the multipath\naddress set alone, and struct nfs4_pnfs_ds records no version. That\nsuffices for the files layout driver, which always connects with version\n4, but flexfiles takes its version tuple from GETDEVICEINFO per device,\nand one address can legitimately serve both NFSv3 and NFSv4.\n\nTwo deviceids on one address with different ds_versions[0].version\ntherefore share a single nfs4_pnfs_ds, and whichever mirror connects\nfirst pins ds_clp to its own version. The other one is handed that\nclient anyway, so it selects rpc_call_ops for a version the connection\ndoes not speak, and the mismatched sequence-slot handling dereferences\nNULL.\n\nAdd the version to the cache key so the two cannot alias, giving each\nversion its own nfs4_pnfs_ds and connection while both mirrors stay\nusable. Only the major version is compared, since that is what selects\nrpc_call_ops and rpc_ops; v4.0 and v4.1 keep sharing a client. The files\nlayout driver passes the 4 it already hardcodes at connect time.(CVE-2026-90102)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Return a delegation the client fails to record\n\nWhen an NFS server grants a delegation in an OPEN reply,\nnfs_inode_set_delegation() records it on the client. However, three\nof its error flows return without sending DELEGRETURN.\n\nA delegation can be relinquished only by DELEGRETURN (RFC 8881\nSection 20.2.4), so dropping one silently leaves the server believing\nthe client still holds it. If the server happens to recall that\ndelegation, the client answers CB_RECALL with NFS4ERR_BADHANDLE\nbecause it has no record of the stateid. The server revokes the\ndelegation and moves it onto its cl_revoked list, because the client\nnever sends the FREE_STATEID that would drain it. Every subsequent\nSEQUENCE reply then carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED,\nand the client\u0026apos;s state manager loops issuing TEST_STATEID across its\ndelegations without ever clearing the condition.\n\nThe window is easy to reach now that a server offers a write\ndelegation on any write OPEN: a delegation recalled for one opener\nraces a re-open that the server answers with a fresh write\ndelegation.\n\nInstead of dropping it, hand the delegation back during these error\nflows.(CVE-2026-90234)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/omap: dsi: Do not copy isr table\n\nTo be able to unregister stuff from isrs, the corresponding table was\ncopied.  Nobody seems to unregister stuff that way, so it does not help.\nBut there are stack-allocated objects passed to these isrs giving chances\nof UAF of these objects if irqs are unregistered while they are handled,\nso better do not copy that table.(CVE-2026-90316)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: synchronize input before cleaning up a failed probe\n\nhid_device_io_start() allows reports to run concurrently with probe. If\nthe probe subsequently fails, __hid_device_probe() releases driver\nresources and clears hdev-\u0026gt;driver without first excluding those report\ncallbacks.\n\nFor example, a report may enter hidraw_report_event() while the failure\npath frees the associated hidraw object, leading to a use-after-free when\nthe report takes the object\u0026apos;s list lock.\n\nStop input before performing failed-probe cleanup. This reacquires\ndriver_input_lock and waits for any report callback already in progress.(CVE-2026-90329)","status":"published","published":"2026-10-16T11:59:44Z","modified":"2026-10-16T12:15:15.099429143Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-74609","description":"In the Linux kernel, the following vulnerability has been resolved: tipc: read le-\u003elink under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n-\u003elock: \tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */ \tif (!l) \t\treturn; \ttipc_node_write_lock(n); \tif (!tipc_link_is_establishing(l)) {\t/* deref l */ \t... \t\ttipc_link_reset(l);\t\t/* write into l */ \tif (delete) { \t\tkfree(l); \t\tle-\u003elink = NULL; The delete=true caller frees that very object under n-\u003elock, so the lock does not protect the cached pointer against it:  - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link    supervision timer via tipc_node_timeout(), reads l unlocked and then    dereferences it under n-\u003elock;  - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()    -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)    -\u003e kfree(l). The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone.  An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch. The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:   BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)   Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0    tipc_link_is_establishing (net/tipc/link.c:285)    tipc_node_link_down (net/tipc/node.c:1076)    tipc_node_timeout (net/tipc/node.c:843)   Allocated by task 9549:    tipc_link_create (net/tipc/link.c:490)    tipc_node_check_dest (net/tipc/node.c:1279)    tipc_disc_rcv (net/tipc/discover.c:252)    tipc_udp_recv (net/tipc/udp_media.c:389)   Freed by task 9549:    tipc_node_link_down (net/tipc/node.c:1084)    tipc_node_delete_links (net/tipc/node.c:1320)    bearer_disable (net/tipc/bearer.c:414)    __tipc_nl_bearer_disable (net/tipc/bearer.c:992) Move the le-\u003elink read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path.  A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T16:16:00Z","modified":"2026-11-10T02:51:30.635832433Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T03:20:23.563598Z"},{"id":"AZL-97062","title":"CVE-2026-74609 affecting package kernel for versions less than 6.6.152.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.","status":"published","published":"2026-08-22T16:16:33Z","modified":"2026-10-02T14:19:10.807105373Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"CLSA-2026-1789141176","title":"kernel: Fix of 131 CVEs","description":"- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}\n- USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}\n- udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}\n- ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}\n- USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n- USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}\n- ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}\n- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n- ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n- tipc: read le-\u003elink under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- sctp: keep chunk-\u003etransport in step with the list it is queued on {CVE-2026-74588}\n- netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}\n- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}\n- nfs: use nfsi-\u003erwsem to protect traversal of the file lock list {CVE-2026-72472}\n- geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}\n- sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}\n- sctp: clear control chunk transport if it is being removed {CVE-2026-74688}\n- udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}\n- bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}\n- RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}\n- libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}\n- drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}\n- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}\n- libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}\n- sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n- Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}\n- net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n- libceph: remove debugfs files before client teardown {CVE-2026-68153}\n- media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}\n- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}\n- pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n- libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}\n- fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}\n- Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}\n- net_sched: red: fix a race in __red_change() {CVE-2025-38108}\n- iio: event: Fix event FIFO reset race {CVE-2026-64496}\n- netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}\n- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}\n- openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}\n- media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}\n- tracing: Fix mmiotrace possible NULL dereferencing of hiter-\u003edev {CVE-2026-68176}\n- tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}\n- bpf: Check validity of link-\u003etype in bpf_link_show_fdinfo() {CVE-2024-53099}\n- bridge: mcast: Fix use-after-free during router port configuration {CVE-2025-38248}\n- ping: Fix potentail NULL deref for /proc/net/icmp. {CVE-2023-53987}\n- cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}\n- tty: n_gsm: Don't block input queue by waiting MSC {CVE-2025-40071}\n- nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}\n- xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}\n- net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}\n- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead {CVE-2024-47672}\n- quota: fix warning in dqgrab() {CVE-2023-54177}\n- scsi: hpsa: Fix possible memory leak in hpsa_init_one() {CVE-2022-50646}\n- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}\n- ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}\n- net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111}\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}\n- iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676}\n- ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}\n- libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}\n- net_sched: drr: Fix double list add in class with netem as child qdisc {CVE-2025-37915}\n- wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}\n- vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check {CVE-2023-53543}\n- net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}\n- nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355}\n- tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313}\n- sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315}\n- smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388}\n- xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment {CVE-2026-68426}\n- ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx-\u003eheadset_codec_dev = NULL {CVE-2023-52697}\n- wifi: mac80211: increase scan_ies_len for S1G {CVE-2025-39957}\n- drm/tests: helpers: Avoid a driver uaf {CVE-2023-53235}\n- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}\n- bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}\n- software node: Correct a OOB check in software_node_get_reference_args() {CVE-2025-38342}\n- x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}\n- xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835}\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value {CVE-2026-46218}\n- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}\n- net_sched: qfq: Fix double list add in class with netem as child qdisc {CVE-2025-37913}\n- kdb: Fix buffer overflow during tab-complete {CVE-2024-39480}\n- ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962}\n- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}\n- RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}\n- bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}\n- bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}\n- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' {CVE-2025-38593}\n- bpf: Fix helper writes to read-only maps {CVE-2024-49861}\n- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}\n- ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}\n- bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu {CVE-2025-68363}\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}\n- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}\n- futex: Prevent use-after-free during requeue-PI {CVE-2025-39977}\n- bpf: Fix invalid prog-\u003estats access when update_effective_progs fails {CVE-2025-68742}\n- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174}\n- gve: Fix stats report corruption on queue count change {CVE-2026-23262}\n- Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}\n- arp: use RCU protection in arp_xmit() {CVE-2025-21762}\n- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}\n- mm/khugepaged: fix -\u003eanon_vma race {CVE-2023-52935}\n- RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}\n- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}\n- wifi: mac80211: tear down new links on vif update error path {CVE-2026-64574}\n- RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582}\n- ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572}\n- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579}\n- iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}\n- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}\n- IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests {CVE-2023-52474}\n- ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}\n- wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}\n- ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}\n- libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update {CVE-2026-68156}\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}\n- openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761}","status":"published","published":"2026-09-11T15:41:34Z","modified":"2026-10-26T09:43:51.243470759Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789898700","title":"kernel: Fix of 163 CVEs","description":"- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}\n- amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}\n- Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}\n- Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}\n- xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}\n- net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}\n- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}\n- cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}\n- fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}\n- cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}\n- pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}\n- Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}\n- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}\n- ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}\n- ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}\n- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}\n- fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}\n- libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}\n- netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}\n- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}\n- bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}\n- sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}\n- netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}\n- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}\n- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}\n- af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}\n- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}\n- Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}\n- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}\n- fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}\n- isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}\n- net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}\n- sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}\n- xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}\n- xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}\n- bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}\n- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}\n- bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}\n- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}\n- bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}\n- bpf: tcp: Make sure iter-\u003ebatch always contains a full bucket snapshot {CVE-2026-64575}\n- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}\n- USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n- NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}\n- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}\n- net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}\n- net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}\n- net: add copy_safe_from_sockptr() helper {CVE-2026-74689}\n- xfs: close crash window in attr dabtree inactivation {CVE-2026-43053}\n- gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots\n- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card {CVE-2025-40085}\n- tee: fix NULL pointer dereference in tee_shm_put {CVE-2025-39865}\n- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229}\n- cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() {CVE-2024-53230}\n- netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}\n- md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}\n- md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}\n- mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}\n- arp: do not assume dev_hard_header() does not change skb-\u003ehead {CVE-2026-22988}\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() {CVE-2026-53357}\n- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() {CVE-2025-37795}\n- hwrng: core - Fix page fault dead lock on mmap-ed hwrng {CVE-2023-52615}\n- ceph: fix possible deadlock when holding Fwb to get inline_data {CVE-2022-49296}\n- bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error {CVE-2024-47728}\n- scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782}\n- xfrm: Wait for RCU readers during policy netns exit {CVE-2026-43091}\n- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}\n- sched/rt: Skip currently executing CPU in rto_next_cpu() {CVE-2026-45919}\n- md/raid5: fix soft lockup in retry_aligned_read() {CVE-2026-46051}\n- tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() {CVE-2026-46196}\n- exit: prevent preemption of oopsing TASK_DEAD task {CVE-2026-46173}\n- netfilter: ipset: stop hash:* range iteration at end {CVE-2026-52921}\n- ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}\n- signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() {CVE-2026-53352}\n- quota: Fix potential NULL pointer dereference {CVE-2024-26878}\n- net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229}\n- udp: clear skb-\u003edev before running a sockmap verdict {CVE-2026-53184}\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146}\n- kasan: remove kasan_find_vm_area() to prevent possible deadlock {CVE-2025-38510}\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds {CVE-2026-68391}\n- net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294}\n- bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}\n- slip: bound decode() reads against the compressed packet length {CVE-2026-45843}\n- netfilter: nf_set_pipapo_avx2: fix initial map fill {CVE-2025-38120}\n- APEI/GHES: ARM processor Error: don't go past allocated memory {CVE-2026-43201}\n- netfilter: nf_tables: unconditionally bump set-\u003enelems before insertion {CVE-2026-23272}\n- usb: typec: ucsi: Fix NULL pointer access {CVE-2025-21918}\n- futex: Prevent use-after-free during requeue-PI {CVE-2025-39977}\n- drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}\n- KVM: nSVM: mark VMCB_LBR dirty at svm_{enable,disable}_lbrv copy sites {CVE-2026-46071}\n- ipv6: fix possible infinite loop in fib6_select_path() {CVE-2026-63968}\n- ipv6: fix possible infinite loop in fib6_info_uses_dev() {CVE-2025-38587}\n- wifi: cfg80211: fix link del callback to call correct handler {CVE-2024-57898}\n- drm/vmwgfx: drop the hash entry when adding a buffer object fails {CVE-2025-40111}\n- sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT {CVE-2026-64374}\n- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path {CVE-2026-64370}\n- netfilter: ebtables: module names must be null-terminated {CVE-2026-64412}\n- Bluetooth: bnep: pin L2CAP connection during netdev registration {CVE-2026-64408}\n- netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}\n- Bluetooth: L2CAP: validate option length before reading conf opt value {CVE-2026-64403}\n- net: af_key: initialize alg_key_len for IPComp states {CVE-2026-64436}\n- tipc: fix out-of-bounds read in broadcast Gap ACK blocks {CVE-2026-64450}\n- audit: Fix data races of skb_queue_len() readers on audit_queue {CVE-2026-64435}\n- USB: serial: keyspan_pda: fix information leak {CVE-2026-64336}\n- USB: serial: digi_acceleport: fix broken rx after throttle {CVE-2026-64335}\n- USB: serial: digi_acceleport: fix hard lockup on disconnect {CVE-2026-64334}\n- isofs: bound Rock Ridge symlink components to the SL record {CVE-2026-64317}\n- crypto: ecc - Fix carry overflow in vli multiplication {CVE-2026-64313}\n- crypto: drbg - Fix returning success on failure in CTR_DRBG {CVE-2026-64306}\n- tracing: Prevent out-of-bounds read in glob matching {CVE-2026-64299}\n- smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}\n- smb: client: harden POSIX SID length parsing {CVE-2026-64380}\n- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}\n- netfilter: nf_tables: release batch on table validation from abort path\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready\n- padata: Reset next CPU when reorder sequence wraps around\n- padata: remove __padata_list_init()\n- usb: free iso schedules on failed submit {CVE-2026-64348}\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove {CVE-2026-64329}\n- udf: validate VAT header length against the VAT inode size {CVE-2026-64323}\n- udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}\n- bpf: Allow LPM map access from sleepable BPF programs {CVE-2026-64352}\n- bpf: Consistently use bpf_rcu_lock_held() everywhere {CVE-2026-64352}\n- vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}\n- smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}\n- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}\n- crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path {CVE-2026-64303}\n- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() {CVE-2025-39944}\n- USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}\n- USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n- USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}\n- USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}\n- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125}\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() {CVE-2026-72126}\n- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}\n- enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}\n- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}\n- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621}\n- net: gro: properly validate BIG TCP aggregation criteria {CVE-2026-80725}\n- mm/ptdump: always stabilise against page table freeing using init_mm {CVE-2026-74599}\n- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF {CVE-2026-74672}\n- sctp: validate cookie AUTH state before use {CVE-2026-74752}\n- sctp: keep chunk-\u003etransport in step with the list it is queued on {CVE-2026-74588}\n- sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}\n- packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}\n- tracing: Fix reading strings from synthetic events {CVE-2022-50255}\n- tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails {CVE-2022-50255}\n- tracing/probes: Fix to update dynamic data counter if fetcharg uses it {CVE-2022-50255}\n- tracing: Add FAULT_STRING macro to trace.h {CVE-2022-50255}\n- tracing: Move duplicate code of trace_kprobe/eprobe.c into header {CVE-2022-50255}\n- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}\n- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib {CVE-2026-31566}\n- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}\n- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}\n- mpls: reload header after pskb_may_pull() {CVE-2026-89555}\n- rhashtable: clear stale iter-\u003ep on table restart {CVE-2026-64563}\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330}\n- bpf: Reject fragmented frames in devmap {CVE-2026-64355}\n- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}\n- ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}\n- tipc: read le-\u003elink under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}\n- treewide: fix cosmetic build warnings introduced by recent backports {CVE-2026-23110}\n- drm/ttm: fix warning that we shouldn't mix \u0026\u0026 and ||\n- mm/mmap: call hugetlb_split() under the i_mmap rwsem {CVE-2025-38084}\n- ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}\n- netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" {CVE-2026-74604}\n- ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n- sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n- ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}\n- NFSv4: nfs4_do_open() is incorrectly triggering state recovery {CVE-2026-72472}\n- nfs: use nfsi-\u003erwsem to protect traversal of the file lock list {CVE-2026-72472}\n- sctp: clear control chunk transport if it is being removed {CVE-2026-74688}\n- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}\n- netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}\n- netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}\n- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704}\n- udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}\n- libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}","status":"published","published":"2026-09-21T19:06:09Z","modified":"2026-10-26T09:43:51.202933125Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789958474","title":"Fix of 167 CVEs","description":"   * CVE-2025-39826\n     - net: rose: convert 'use' field to refcount_t {CVE-2025-39826}\n   * CVE-2025-40146\n     - blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}\n   * CVE-2024-53216\n     - nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}\n   * CVE-2026-89778\n     - isofs: fix out-of-bounds page array access on empty zisofs block\n       {CVE-2026-89778}\n   * CVE-2026-23050\n     - pNFS: Fix a deadlock when returning a delegation during open()\n       {CVE-2026-23050}\n   * CVE-2025-68796\n     - f2fs: fix to avoid updating zero-sized extent in extent cache\n       {CVE-2025-68796}\n   * CVE-2025-68330\n     - iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}\n   * CVE-2025-40333\n     - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}\n   * CVE-2025-40160\n     - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}\n   * CVE-2023-54047\n     - drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}\n   * CVE-2025-68190\n     - drm/amdgpu/atom: Check kcalloc() for WS buffer in\n       amdgpu_atom_execute_table_locked() {CVE-2025-68190}\n   * CVE-2025-68188\n     - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()\n       {CVE-2025-68188}\n   * CVE-2026-89786\n     - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}\n   * CVE-2022-50764\n     - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}\n   * CVE-2026-80785\n     - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}\n   * CVE-2026-80788\n     - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations\n       {CVE-2026-80788}\n   * CVE-2026-80747\n     - drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}\n   * CVE-2026-80907\n     - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}\n   * CVE-2026-80908\n     - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}\n   * CVE-2026-80812\n     - ALSA: dummy: Check card index validity at probe {CVE-2026-80812}\n   * CVE-2026-80948\n     - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()\n       {CVE-2026-80948}\n   * CVE-2025-40137\n     - f2fs: fix to truncate first page in error path of f2fs_truncate()\n       {CVE-2025-40137}\n   * CVE-2023-54150\n     - drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}\n   * CVE-2026-89784\n     - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6\n       {CVE-2026-89784}\n   * CVE-2026-89783\n     - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full\n       {CVE-2026-89783}\n   * CVE-2026-89780\n     - net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames\n       {CVE-2026-89780}\n   * CVE-2026-89777\n     - vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n       {CVE-2026-89777}\n   * CVE-2026-89789\n     - gtp: add synchronize_net() in gtp_newlink() error path to prevent\n       use-after-free {CVE-2026-89789}\n   * CVE-2025-68797\n     - char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}\n   * CVE-2025-68767\n     - hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}\n   * CVE-2026-63961\n     - usb: typec: altmodes/displayport: validate count before reading Status\n       Update VDO {CVE-2026-63961}\n   * CVE-2026-63904\n     - usb: usbtmc: check URB actual_length for interrupt-IN notifications\n       {CVE-2026-63904}\n   * CVE-2022-50864\n     - nilfs2: fix shift-out-of-bounds due to too large exponent of block size\n       {CVE-2022-50864}\n   * CVE-2025-68771\n     - ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}\n   * CVE-2025-68750\n     - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}\n   * CVE-2026-80909\n     - drm/amdgpu: Reject UVD message with invalid number of h265 refs\n       {CVE-2026-80909}\n   * CVE-2026-74402\n     - crypto: atmel-sha204a - fix blocking and non-blocking rng logic\n       {CVE-2026-74402}\n   * CVE-2026-80844\n     - xfrm: ah6: validate routing header segments_left {CVE-2026-80844}\n   * CVE-2026-80732\n     - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732}\n   * CVE-2026-80823\n     - nfc: st21nfca: validate ATR_REQ length against the received frame\n       {CVE-2026-80823}\n   * CVE-2026-89733\n     - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and\n       uvc_function_unbind() {CVE-2026-89733}\n   * CVE-2026-80570\n     - Input: synaptics-rmi4 - zero report size on F54 work error\n       {CVE-2026-80570}\n   * CVE-2026-80600\n     - batman-adv: dat: acquire ARP hw source only after skb realloc\n       {CVE-2026-80600}\n   * CVE-2026-74580\n     - vhost: reset the vring metadata cache on vring reconfiguration\n       {CVE-2026-74580}\n   * CVE-2026-74609\n     - tipc: read le-\u003elink under the node lock in tipc_node_link_down()\n       {CVE-2026-74609}\n   * CVE-2026-68188\n     - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}\n   * CVE-2026-74505\n     - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}\n   * CVE-2026-74583\n     - net/sched: cls_route: fix fastmap use-after-free on filter\n       {CVE-2026-74583}\n   * CVE-2026-72299\n     - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299}\n   * CVE-2026-89607\n     - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n       {CVE-2026-89607}\n   * CVE-2026-74444\n     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n       {CVE-2026-74444}\n   * CVE-2026-72234\n     - batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n       {CVE-2026-72234}\n   * CVE-2026-68357\n     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()\n       {CVE-2026-68357}\n   * CVE-2026-74588\n     - sctp: keep chunk-\u003etransport in step with the list it is queued on\n       {CVE-2026-74588}\n   * CVE-2026-74548\n     - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548}\n   * CVE-2026-64563\n     - rhashtable: clear stale iter-\u003ep on table restart {CVE-2026-64563}\n   * CVE-2026-68373\n     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n       {CVE-2026-68373}\n   * CVE-2026-74556\n     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection\n       buffer {CVE-2026-74556}\n   * CVE-2026-68158\n     - libceph: Fix multiplication overflow in decode_new_up_state_weight()\n       {CVE-2026-68158}\n   * CVE-2026-74656\n     - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}\n   * CVE-2026-64483\n     - ALSA: firewire: isight: bound the sample count to the packet payload\n       {CVE-2026-64483}\n   * CVE-2026-63814\n     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}\n   * CVE-2026-64505\n     - usb: gadget: function: rndis: add length check for header {CVE-2026-64505}\n   * CVE-2026-63823\n     - keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823}\n   * CVE-2026-72233\n     - batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233}\n   * CVE-2026-68121\n     - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n   * CVE-2026-74660\n     - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}\n   * CVE-2026-74255\n     - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255}\n   * CVE-2026-64504\n     - iio: accel: bmc150: clamp the device-reported FIFO frame count\n       {CVE-2026-64504}\n   * CVE-2026-72047\n     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit\n       {CVE-2026-72047}\n   * CVE-2026-68214\n     - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}\n   * CVE-2026-68402\n     - wifi: cfg80211: bound element ID read when checking non-inheritance\n       {CVE-2026-68402}\n   * CVE-2026-72351\n     - gue: validate REMCSUM private option length {CVE-2026-72351}\n   * CVE-2026-72171\n     - mtd: slram: remove failed entries from the device list {CVE-2026-72171}\n   * CVE-2026-68144\n     - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}\n   * CVE-2026-74667\n     - net/packet: reset the MAC header on the packet-socket transmit path\n       {CVE-2026-74667}\n   * CVE-2026-80601\n     - batman-adv: gw: acquire ethernet header only after skb realloc\n       {CVE-2026-80601}\n   * CVE-2026-68377\n     - net/sched: act_tunnel_key: Defer dst_release to RCU callback\n       {CVE-2026-68377}\n   * CVE-2026-72374\n     - afs: Fix callback service message parsers to pass through -EAGAIN\n       {CVE-2026-72374}\n   * CVE-2026-74705\n     - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}\n   * CVE-2026-74630\n     - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n   * CVE-2026-74679\n     - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679}\n   * CVE-2026-68153\n     - libceph: remove debugfs files before client teardown {CVE-2026-68153}\n   * CVE-2026-72083\n     - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n       {CVE-2026-72083}\n   * CVE-2026-68143\n     - net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n   * CVE-2026-68335\n     - rds: drop incoming messages that cross network namespace boundaries\n       {CVE-2026-68335}\n   * CVE-2026-72406\n     - net: sungem: fix probe error cleanup {CVE-2026-72406}\n   * CVE-2026-74394\n     - RDMA/srpt: fix integer overflow in immediate data length check\n       {CVE-2026-74394}\n   * CVE-2026-68376\n     - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n   * CVE-2026-72014\n     - drbd: reject data replies with an out-of-range payload size\n       {CVE-2026-72014}\n   * CVE-2026-64471\n     - Bluetooth: btusb: fix use-after-free on registration failure\n       {CVE-2026-64471}\n   * CVE-2026-80590\n     - inet: frags: strip GSO state from fragments before reassembly\n       {CVE-2026-80590}\n   * CVE-2026-74408\n     - wifi: ath9k: fix OOB access from firmware tx status queue ID\n       {CVE-2026-74408}\n   * CVE-2026-68160\n     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n       {CVE-2026-68160}\n   * CVE-2026-72296\n     - net: ife: require ETH_HLEN to be pullable in ife_decode() {CVE-2026-72296}\n   * CVE-2026-80622\n     - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}\n   * CVE-2026-68363\n     - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware\n       request {CVE-2026-68363}\n   * CVE-2026-80558\n     - libceph: Avoid using invalid osd indices from primary_temp\n       {CVE-2026-80558}\n   * CVE-2026-68199\n     - wifi: ath6kl: fix OOB access from firmware ADDBA window size\n       {CVE-2026-68199}\n   * CVE-2026-89724\n     - media: vicodec: fix out-of-bounds write in FWHT encoder {CVE-2026-89724}\n   * CVE-2026-89720\n     - ubifs: fix out-of-bounds read in signature length check {CVE-2026-89720}\n   * CVE-2026-89674\n     - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n       {CVE-2026-89674}\n   * CVE-2026-89729\n     - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n       {CVE-2026-89729}\n   * CVE-2026-89742\n     - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742}\n   * CVE-2026-64375\n     - proc: protect ptrace_may_access() with exec_update_lock (FD links)\n       {CVE-2026-64375}\n   * CVE-2026-64378\n     - writeback: fix race between cgroup_writeback_umount() and\n       inode_switch_wbs() {CVE-2026-64378}\n   * CVE-2026-64448\n     - smb: client: restrict implied bcc[0] exemption to responses without data\n       area {CVE-2026-64448}\n   * CVE-2026-64381\n     - smb: client: Fix next buffer leak in receive_encrypted_standard()\n       {CVE-2026-64381}\n   * CVE-2026-64379\n     - smb: client: mask server-provided mode to 07777 in modefromsid\n       {CVE-2026-64379}\n   * CVE-2026-64445\n     - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()\n       {CVE-2026-64445}\n   * CVE-2026-64440\n     - staging: rtl8723bs: fix OOB write in HT_caps_handler() {CVE-2026-64440}\n   * CVE-2026-64446\n     - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n       {CVE-2026-64446}\n   * CVE-2026-64442\n     - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and\n       join_cmd_hdl() {CVE-2026-64442}\n   * CVE-2026-64443\n     - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n       {CVE-2026-64443}\n   * CVE-2026-64438\n     - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n       {CVE-2026-64438}\n   * CVE-2026-64305\n     - crypto: qat - protect service table iterations with service_lock\n       {CVE-2026-64305}\n   * CVE-2026-64341\n     - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}\n   * CVE-2026-64344\n     - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n   * CVE-2026-64340\n     - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}\n   * CVE-2026-64422\n     - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes\n       {CVE-2026-64422}\n   * CVE-2026-64424\n     - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}\n   * CVE-2026-64423\n     - ipv4: igmp: remove multicast group from hash table on device destruction\n       {CVE-2026-64423}\n   * CVE-2026-64420\n     - mfd: cros_ec: Delay dev_set_drvdata() until probe success {CVE-2026-64420}\n   * CVE-2026-64343\n     - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n   * CVE-2026-64330\n     - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n       {CVE-2026-64330}\n   * CVE-2026-64449\n     - staging: vme_user: bound slave read/write to the kern_buf size\n       {CVE-2026-64449}\n   * CVE-2026-64348\n     - usb: free iso schedules on failed submit {CVE-2026-64348}\n   * CVE-2026-64304\n     - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}\n   * CVE-2026-64452\n     - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452}\n   * CVE-2026-64372\n     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n       {CVE-2026-64372}\n   * CVE-2026-64351\n     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n       {CVE-2026-64351}\n   * CVE-2026-64342\n     - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}\n   * CVE-2026-64323\n     - udf: validate VAT header length against the VAT inode size\n       {CVE-2026-64323}\n   * CVE-2026-64322\n     - udf: validate sparing table length as an entry count, not a byte count\n       {CVE-2026-64322}\n   * CVE-2026-64318\n     - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318}\n   * CVE-2026-64320\n     - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n       {CVE-2026-64320}\n   * CVE-2026-31727\n     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n       {CVE-2026-31727}\n   * CVE-2026-46275\n     - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n       {CVE-2026-46275}\n   * CVE-2026-43449\n     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}\n   * CVE-2026-43015\n     - net: macb: fix clk handling on PCI glue driver removal {CVE-2026-43015}\n   * CVE-2026-68156\n     - libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n       {CVE-2026-68156}\n   * CVE-2025-39987\n     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow\n       {CVE-2025-39987}\n   * CVE-2025-39985\n     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow\n       {CVE-2025-39985}\n   * CVE-2026-64237\n     - Input: elan_i2c - validate firmware size before use {CVE-2026-64237}\n   * CVE-2025-68217\n     - Input: pegasus-notetaker - fix potential out-of-bounds access\n       {CVE-2025-68217}\n   * CVE-2026-43279\n     - ALSA: usb-audio: Add sanity check for OOB writes at silencing\n       {CVE-2026-43279}\n   * CVE-2026-52991\n     - sched/psi: fix race between file release and pressure write\n       {CVE-2026-52991}\n   * CVE-2026-53355\n     - net: rds: clear i_sends on setup unwind {CVE-2026-53355}\n   * CVE-2026-52942\n     - netfilter: nf_log: validate MAC header was set before dumping it\n       {CVE-2026-52942}\n   * CVE-2026-53189\n     - mm/huge_memory: update file PMD counter before folio_put()\n       {CVE-2026-53189}\n   * CVE-2026-53264\n     - net/sched: act_api: use RCU with deferred freeing for action lifecycle\n       {CVE-2026-53264}\n   * CVE-2026-45970\n     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}\n   * CVE-2026-52920\n     - netfilter: xt_policy: fix strict mode inbound policy matching\n       {CVE-2026-52920}\n   * CVE-2026-46209\n     - drm/gem: Fix inconsistent plane dimension calculation {CVE-2026-46209}\n   * CVE-2026-45856\n     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send\n       {CVE-2026-45856}\n   * CVE-2026-53040\n     - ocfs2: validate bg_bits during freefrag scan {CVE-2026-53040}\n   * CVE-2026-53130\n     - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n       {CVE-2026-53130}\n   * CVE-2026-43198\n     - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}\n   * CVE-2025-40082\n     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-40082}\n   * CVE-2024-53179\n     - cifs: fix use-after-free of signing key {CVE-2024-53179}\n   * CVE-2024-49861\n     - bpf: Fix helper writes to read-only maps {CVE-2024-49861}\n   * CVE-2022-50151\n     - usb: cdns3: fix random warning message when driver load {CVE-2022-50151}\n   * CVE-2022-47519\n     - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL\n       attribute {CVE-2022-47519}\n   * CVE-2026-23105\n     - net/sched: qfq: Use cl_is_active to determine whether class is active in\n       qfq_rm_from_ag {CVE-2026-23105}\n   * CVE-2026-43158\n     - xfs: fix freemap adjustments when adding xattrs to leaf blocks\n       {CVE-2026-43158}\n   * Miscellaneous upstream changes\n     - net: rose: split remove and free operations in rose_remove_neigh()\n     - af_unix: read the receive queue tail length under the queue lock in\n       unix_stream_data_wait()\n     - media: rc: Use the correct style for SPDX License Identifier\n     - Revert \"Revert \"sctp: Fix bundling of SHUTDOWN with COOKIE-ACK\"\"\n     - Revert \"sctp: Fix bundling of SHUTDOWN with COOKIE-ACK\"\n   * Bump ABI 5.4.0-238","status":"published","published":"2026-09-21T15:55:34Z","modified":"2026-10-26T09:43:27.456673278Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791800936","title":"kernel: Fix of 191 CVEs","description":"- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}\n- openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}\n- openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}\n- NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}\n- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}\n- exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}\n- proc: Fix broken error paths for namespace links {CVE-2026-64371}\n- proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}\n- ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}\n- usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}\n- arp: do not assume dev_hard_header() does not change skb-\u003ehead {CVE-2026-22988}\n- netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}\n- md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}\n- md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}\n- mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}\n- vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}\n- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}\n- mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}\n- udf: validate VAT header length against the VAT inode size {CVE-2026-64323}\n- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}\n- slip: bound decode() reads against the compressed packet length {CVE-2026-45843}\n- net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}\n- netfilter: nf_tables: unconditionally bump set-\u003enelems before insertion {CVE-2026-23272}\n- rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}\n- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}\n- mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}\n- bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}\n- bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}\n- nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}\n- bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}\n- x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}\n- ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}\n- drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}\n- libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}\n- gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}\n- smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}\n- ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}\n- NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}\n- netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}\n- smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}\n- smb: client: harden POSIX SID length parsing {CVE-2026-64380}\n- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}\n- bpf: Allow LPM map access from sleepable BPF programs {CVE-2026-64352}\n- bpf: Consistently use bpf_rcu_lock_held() everywhere {CVE-2026-64352}\n- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621}\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" {CVE-2026-74604}\n- ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}\n- ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330}\n- mpls: reload header after pskb_may_pull() {CVE-2026-89555}\n- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}\n- sctp: keep chunk-\u003etransport in step with the list it is queued on {CVE-2026-74588}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n- USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path {CVE-2026-64303}\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove {CVE-2026-64329}\n- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib {CVE-2026-31566}\n- ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer {CVE-2026-64034}\n- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}\n- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion {CVE-2025-37891}\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 {CVE-2026-53143}\n- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}\n- net: tun: bound receive headroom {CVE-2026-81000}\n- smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}\n- smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}\n- xsk: require at least 16 bytes of TX metadata {CVE-2026-74710}\n- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}\n- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}\n- smb: client: fix use-after-free of iface in cifs_try_adding_channels() {CVE-2026-74608}\n- smb: mark the new channel addition log as informational log with cifs_info {CVE-2026-74608}\n- smb: client: Fix use-after-free in cifs_try_adding_channels() {CVE-2026-74608}\n- udf: reject VAT indexes equal to the entry count {CVE-2026-89525}\n- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 {CVE-2026-45878}\n- smb: client: fix double-free in SMB2_open() replay {CVE-2026-64382}\n- smb: client: fix change notify replay double-free {CVE-2026-64384}\n- smb: client: fix query_info() replay double-free {CVE-2026-64386}\n- smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379}\n- net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete {CVE-2026-72072}\n- netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}\n- video: screen_info: Relocate framebuffers behind PCI bridges {CVE-2025-38427}\n- erofs: fix the out-of-bounds nameoff handling for trailing dirents {CVE-2026-46078}\n- ceph: fix memory leak in ceph_direct_read_write() {CVE-2024-56710}\n- KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 {CVE-2026-46071}\n- drm/amdgpu: Release VFCT ACPI table reference {CVE-2026-68238}\n- dm cache metadata: fix memory leak on metadata abort retry {CVE-2026-53060}\n- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching {CVE-2026-52999}\n- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}\n- bpf: Preserve id of register in sync_linked_regs() {CVE-2026-45933}\n- bpf: Fix regsafe() for pointers to packet {CVE-2026-43030}\n- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241}\n- perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list {CVE-2025-21895}\n- net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254}\n- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference {CVE-2025-40042}\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled {CVE-2026-68085}\n- media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216}\n- Bluetooth: SMP: derive legacy responder STK authentication from MITM state {CVE-2026-31773}\n- Bluetooth: fix memory leak in error path of hci_alloc_dev() {CVE-2026-53252}\n- mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}\n- ext4: refresh inline data size before write operations {CVE-2025-68264}\n- kernfs: Relax constraint in draining guard {CVE-2025-38282}\n- netfilter: x_tables: ensure names are nul-terminated {CVE-2026-43028}\n- nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net {CVE-2026-89682}\n- smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}\n- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125}\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() {CVE-2026-72126}\n- netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}\n- mm/debug_vm_pgtable: clear page table entries at destroy_args() {CVE-2025-39776}\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}\n- ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n- tipc: read le-\u003elink under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}\n- rhashtable: clear stale iter-\u003ep on table restart {CVE-2026-64563}\n- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}\n- sctp: validate cookie AUTH state before use {CVE-2026-74752}\n- sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}\n- USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n- USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}\n- vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}\n- usb: free iso schedules on failed submit {CVE-2026-64348}\n- udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}\n- drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}\n- packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}\n- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}\n- crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}\n- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n- drm/xe: Use local fence in error path of xe_migrate_clear {CVE-2025-37869}\n- nvmet-auth: validate reply message payload bounds against transfer length {CVE-2026-64319}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() {CVE-2026-43037}\n- smb: client: fix query directory replay double-free {CVE-2026-64387}\n- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}\n- xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}\n- enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018}\n- bpf: Simplify sanitize_err() signature {CVE-2026-74720}\n- bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}\n- sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}\n- smb: client: fix double-free in SMB2_flush() replay {CVE-2026-64383}\n- smb: client: fix double-free in SMB2_ioctl() replay {CVE-2026-64385}\n- smb: client: fix double-free in SMB2_close() replay {CVE-2026-64597}\n- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() {CVE-2026-72069}\n- dm-verity: fix buffer overflow in FEC calculation {CVE-2026-72098}\n- dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS {CVE-2026-72098}\n- dm-verity-fec: fix the size of dm_verity_fec_io::erasures {CVE-2026-72098}\n- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}\n- locking/spinlock/debug: Fix data-race in do_raw_write_lock {CVE-2025-68336}\n- hsr: Remove WARN_ONCE() in hsr_addr_is_self(). {CVE-2026-53353}\n- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). {CVE-2025-22005}\n- x86/fpu: Ensure shadow stack is active before \"getting\" registers {CVE-2025-21632}\n- perf/core: Add RCU read lock protection to perf_iterate_ctx() {CVE-2025-21889}\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU {CVE-2026-31593}\n- genetlink: fix genl_bind() invoking bind() after -EPERM {CVE-2025-39926}\n- fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044}\n- rxrpc: Only put the call ref if one was acquired {CVE-2026-31638}\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835}\n- bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}\n- pid: Add a judgment for ns null in pid_nr_ns {CVE-2025-40178}\n- arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR {CVE-2024-57878}\n- kunit: Fix potential null dereference in kunit_device_driver_test() {CVE-2024-56773}\n- arm64/fpsimd: Discard stale CPU state when handling SME traps {CVE-2025-38170}\n- mm: hugetlb: avoid soft lockup when mprotect to large memory area {CVE-2025-40153}\n- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. {CVE-2025-37936}\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls {CVE-2026-46131}\n- netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}\n- openvswitch: validate MPLS set/set_masked payload length {CVE-2026-31679}\n- tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280}\n- nfs4_setup_readdir(): insufficient locking for -\u003ed_parent-\u003ed_inode dereferencing {CVE-2025-68185}\n- devlink: fix xa_alloc_cyclic() error handling {CVE-2025-22017}\n- net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir {CVE-2026-53014}\n- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() {CVE-2025-37791}\n- xfrm: prevent policy_hthresh.work from racing with netns teardown {CVE-2026-31516}\n- blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() {CVE-2026-53126}\n- rxrpc: Fix key reference count leak from call-\u003ekey {CVE-2026-31639}\n- xsk: fix refcount underflow in error path {CVE-2023-53698}\n- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704}\n- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky {CVE-2026-43296}\n- drm/xe/userptr: fix EFAULT handling {CVE-2025-21880}\n- bpf: fix mm lifecycle in open-coded task_vma iterator {CVE-2026-53085}\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() {CVE-2026-46201}\n- udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}\n- netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}\n- netfilter: ipset: stop hash:* range iteration at end {CVE-2026-52921}\n- ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}\n- tee: fix NULL pointer dereference in tee_shm_put {CVE-2025-39865}\n- KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU {CVE-2026-64287}\n- regulator: core: fix locking in regulator_resolve_supply() error path {CVE-2026-46252}\n- tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() {CVE-2026-46196}\n- exit: prevent preemption of oopsing TASK_DEAD task {CVE-2026-46173}\n- EFI/CPER: don't dump the entire memory region {CVE-2026-43171}\n- libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}\n- RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178}\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350}\n- svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails {CVE-2026-89534}\n- mptcp: avoid deadlock on fallback while reinjecting\n- mptcp: plug races between subflow fail and subflow creation {CVE-2025-38552}\n- mptcp: make fallback action and fallback decision atomic","status":"published","published":"2026-10-21T10:25:55Z","modified":"2026-10-26T09:43:19.007549271Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791876326","title":"Fix of 274 CVEs","description":"   * CVE-2026-53091\n     - xfrm: Don't clobber inner headers when already set {CVE-2026-53091}\n     - net: account for encap headers in qdisc pkt len {CVE-2026-53091}\n   * CVE-2026-93803\n     - wifi: libipw: fix key index receive bound checks {CVE-2026-93803}\n   * CVE-2026-93286\n     - net: appletalk: fix NULL pointer dereference in aarp_send_ddp()\n       {CVE-2026-93286}\n   * CVE-2026-93280\n     - greybus: audio: bound the topology section sizes against the fetched size\n       {CVE-2026-93280}\n   * CVE-2026-93213\n     - of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}\n   * CVE-2026-93802\n     - wifi: rsi: validate beacon length before fixed buffer copy\n       {CVE-2026-93802}\n   * CVE-2026-93206\n     - PCI/proc: Use file_ns_capable() when checking config space read access\n       {CVE-2026-93206}\n   * CVE-2026-97448\n     - ACPICA: Add validation for node in acpi_ns_build_normalized_path()\n       {CVE-2026-97448}\n   * CVE-2026-97408\n     - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}\n   * CVE-2026-93268\n     - ext4: skip extra isize expansion during mount to prevent deadlock\n       {CVE-2026-93268}\n   * CVE-2026-93782\n     - vhost-scsi: flush backend after device ioctls {CVE-2026-93782}\n   * CVE-2026-93783\n     - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame\n       {CVE-2026-93783}\n   * CVE-2026-97455\n     - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n       {CVE-2026-97455}\n   * CVE-2026-93807\n     - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers\n       {CVE-2026-93807}\n   * CVE-2026-93808\n     - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}\n   * CVE-2026-89938\n     - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove\n       UAF {CVE-2026-89938}\n   * CVE-2026-89927\n     - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock\n       {CVE-2026-89927}\n   * CVE-2026-89949\n     - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}\n   * CVE-2026-89912\n     - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save\n       {CVE-2026-89912}\n   * CVE-2026-89932\n     - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}\n   * CVE-2026-89833\n     - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()\n       {CVE-2026-89833}\n   * CVE-2026-90045\n     - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}\n   * CVE-2026-89854\n     - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}\n   * CVE-2026-90015\n     - xhci: fix lost bounce buffers on TDs spanning several ring segments\n       {CVE-2026-90015}\n   * CVE-2026-89979\n     - ALSA: pcm: Fix race between non-atomic ops and trigger-start\n       {CVE-2026-89979}\n   * CVE-2026-89852\n     - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()\n       {CVE-2026-89852}\n   * CVE-2026-89861\n     - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n       {CVE-2026-89861}\n   * CVE-2026-89859\n     - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak\n       {CVE-2026-89859}\n   * CVE-2026-90036\n     - NFSD: Prevent client use-after-free during blocked-lock reaping\n       {CVE-2026-90036}\n   * CVE-2026-89987\n     - mm/huge_memory: transfer the pmd dirty bit to the folio on zap\n       {CVE-2026-89987}\n   * CVE-2026-89799\n     - bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}\n   * CVE-2026-90032\n     - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}\n   * CVE-2026-89822\n     - drm/i915: Guard against NULL driver_data in i915_pci_probe()\n       {CVE-2026-89822}\n   * CVE-2026-89929\n     - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU\n       {CVE-2026-89929}\n   * CVE-2026-89840\n     - f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}\n   * CVE-2026-89913\n     - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables\n       {CVE-2026-89913}\n   * CVE-2026-89865\n     - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers\n       {CVE-2026-89865}\n   * CVE-2026-90000\n     - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}\n   * CVE-2026-89972\n     - nvme: add missing SRCU grace period in error path {CVE-2026-89972}\n   * CVE-2026-90049\n     - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n       {CVE-2026-90049}\n   * CVE-2026-89856\n     - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation\n       {CVE-2026-89856}\n   * CVE-2026-90037\n     - NFSD: Prevent client use-after-free during close_lru reaping\n       {CVE-2026-90037}\n   * CVE-2026-89948\n     - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948}\n   * CVE-2026-90023\n     - usb: gadget: f_mass_storage: fix null pointer dereference in\n       fsg_common_set_num_buffers() {CVE-2026-90023}\n   * CVE-2026-90020\n     - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()\n       {CVE-2026-90020}\n   * CVE-2026-89838\n     - f2fs: limit recovery filename logging to stored length {CVE-2026-89838}\n   * CVE-2026-89848\n     - scsi: qla2xxx: Quiesce response IRQ before freeing request queue\n       {CVE-2026-89848}\n   * CVE-2026-90017\n     - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()\n       {CVE-2026-90017}\n   * CVE-2026-89897\n     - media: cec: Serialize exclusive follower delivery {CVE-2026-89897}\n   * CVE-2026-89877\n     - media: saa7164: fix cleanup on resource allocation failure\n       {CVE-2026-89877}\n   * CVE-2026-89952\n     - mtd: rawnand: validate ONFI extended parameter page sections\n       {CVE-2026-89952}\n   * CVE-2026-90016\n     - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}\n   * CVE-2026-89999\n     - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n       {CVE-2026-89999}\n   * CVE-2026-90044\n     - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}\n   * CVE-2026-90029\n     - usb: storage: realtek_cr: fix use-after-free on disconnect\n       {CVE-2026-90029}\n   * CVE-2026-89783\n     - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full\n       {CVE-2026-89783}\n   * CVE-2026-89778\n     - isofs: fix out-of-bounds page array access on empty zisofs block\n       {CVE-2026-89778}\n   * CVE-2026-89845\n     - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n       {CVE-2026-89845}\n   * CVE-2026-89946\n     - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946}\n   * CVE-2026-89846\n     - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n       {CVE-2026-89846}\n   * CVE-2026-89965\n     - nvdimm/btt: reject an arena whose nfree is below the lane count\n       {CVE-2026-89965}\n   * CVE-2026-89945\n     - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945}\n   * CVE-2026-89953\n     - mtd: mtdoops: free page bitmap when the backing MTD is removed\n       {CVE-2026-89953}\n   * CVE-2026-89855\n     - scsi: qla2xxx: Serialize flash version read in reset handler\n       {CVE-2026-89855}\n   * CVE-2026-89936\n     - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936}\n   * CVE-2026-90031\n     - usb-storage: ene_ub6250: fix race between scan work and probe\n       {CVE-2026-90031}\n   * CVE-2026-89901\n     - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL\n       deref {CVE-2026-89901}\n   * CVE-2026-89878\n     - media: s2255: check firmware size before reading trailing marker\n       {CVE-2026-89878}\n   * CVE-2026-89890\n     - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890}\n   * CVE-2026-89893\n     - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}\n   * CVE-2026-89951\n     - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951}\n   * CVE-2026-90034\n     - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034}\n   * CVE-2026-90033\n     - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n       {CVE-2026-90033}\n   * CVE-2026-90007\n     - scsi: pm8001: Use rollback index when freeing MSI-X vectors\n       {CVE-2026-90007}\n   * CVE-2026-90011\n     - scsi: target: iscsi: Reserve a terminator byte for the login payload\n       {CVE-2026-90011}\n   * CVE-2026-90013\n     - tracing: Take trace_array reference when opening options file\n       {CVE-2026-90013}\n   * CVE-2026-89843\n     - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak\n       {CVE-2026-89843}\n   * CVE-2026-89982\n     - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982}\n   * CVE-2026-89997\n     - dm: fix resume-vs-remove race {CVE-2026-89997}\n   * CVE-2026-90019\n     - usb: gadget: fix null pointer dereference in usb_put_function_instance()\n       {CVE-2026-90019}\n   * CVE-2026-89895\n     - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895}\n   * CVE-2026-89858\n     - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()\n       {CVE-2026-89858}\n   * CVE-2026-89864\n     - scsi: qla2xxx: Bound i2c-\u003elength in I2C bsg handlers {CVE-2026-89864}\n   * CVE-2026-89784\n     - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6\n       {CVE-2026-89784}\n   * CVE-2026-89789\n     - gtp: add synchronize_net() in gtp_newlink() error path to prevent\n       use-after-free {CVE-2026-89789}\n   * CVE-2026-89786\n     - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}\n   * CVE-2023-54047\n     - drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}\n   * CVE-2025-40146\n     - blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}\n   * CVE-2026-68367\n     - usb: gadget: f_tcm: synchronize delayed set_alt with teardown\n       {CVE-2026-68367}\n   * CVE-2026-89659\n     - NFSD: Prevent client use-after-free during delegation revoke\n       {CVE-2026-89659}\n   * CVE-2026-80841\n     - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}\n   * CVE-2026-80925\n     - vlan: fix skb_under_panic and races when toggling HW VLAN offload\n       {CVE-2026-80925}\n   * CVE-2026-64557\n     - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n       {CVE-2026-64557}\n   * CVE-2026-72390\n     - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF\n       {CVE-2026-72390}\n   * CVE-2026-80994\n     - net: openvswitch: fix flow mask use-after-free on flow deletion\n       {CVE-2026-80994}\n   * CVE-2026-74752\n     - sctp: validate cookie AUTH state before use {CVE-2026-74752}\n   * CVE-2026-68404\n     - wifi: cfg80211: use wiphy work for socket owner autodisconnect\n       {CVE-2026-68404}\n   * CVE-2026-72413\n     - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}\n   * CVE-2026-63921\n     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}\n   * CVE-2026-23050\n     - pNFS: Fix a deadlock when returning a delegation during open()\n       {CVE-2026-23050}\n   * CVE-2025-68190\n     - drm/amdgpu/atom: Check kcalloc() for WS buffer in\n       amdgpu_atom_execute_table_locked() {CVE-2025-68190}\n   * CVE-2026-63933\n     - iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933}\n   * CVE-2023-54287\n     - tty: serial: imx: disable Ageing Timer interrupt request irq\n       {CVE-2023-54287}\n   * CVE-2026-63891\n     - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n       {CVE-2026-63891}\n   * CVE-2024-50076\n     - vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}\n   * CVE-2021-47659\n     - drm/plane: Move range check for format_count earlier {CVE-2021-47659}\n   * CVE-2026-63983\n     - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}\n   * CVE-2025-68342\n     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before\n       accessing data {CVE-2025-68342}\n   * CVE-2026-63922\n     - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}\n   * CVE-2023-54007\n     - vmci_host: fix a race condition in vmci_host_poll() causing GPF\n       {CVE-2023-54007}\n   * CVE-2025-68173\n     - ftrace: Fix softlockup in ftrace_module_enable {CVE-2025-68173}\n   * CVE-2022-50864\n     - nilfs2: fix shift-out-of-bounds due to too large exponent of block size\n       {CVE-2022-50864}\n   * CVE-2026-63905\n     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n       {CVE-2026-63905}\n   * CVE-2025-40100\n     - btrfs: do not assert we found block group item when creating free space\n       tree {CVE-2025-40100}\n   * CVE-2025-40333\n     - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}\n   * CVE-2025-40160\n     - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}\n   * CVE-2026-63888\n     - scsi: target: iscsi: Fix CRC overread and double-free in\n       iscsit_handle_text_cmd() {CVE-2026-63888}\n   * CVE-2025-68778\n     - btrfs: don't log conflicting inode if it's a dir moved in the current\n       transaction {CVE-2025-68778}\n   * CVE-2023-53799\n     - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}\n   * CVE-2026-64009\n     - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}\n   * CVE-2023-54226\n     - af_unix: Fix data races around sk-\u003esk_shutdown. {CVE-2023-54226}\n   * CVE-2022-50770\n     - ocfs2: fix memory leak in ocfs2_mount_volume() {CVE-2022-50770}\n   * CVE-2022-4994\n     - KVM: x86: wean fast IN from emulator_pio_in {CVE-2022-4994}\n   * CVE-2024-50135\n     - nvme-pci: fix race condition between reset and nvme_dev_disable()\n       {CVE-2024-50135}\n   * CVE-2026-64011\n     - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}\n   * CVE-2026-80786\n     - fbdev: Wrap user-invoked calls to fb_set_var() in helper {CVE-2026-80786}\n   * CVE-2022-50774\n     - crypto: qat - fix DMA transfer direction {CVE-2022-50774}\n   * CVE-2023-53834\n     - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match\n       {CVE-2023-53834}\n   * CVE-2026-74444\n     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n       {CVE-2026-74444}\n   * CVE-2022-50764\n     - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}\n   * CVE-2026-80794\n     - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers\n       {CVE-2026-80794}\n   * CVE-2026-80854\n     - usb: gadget: f_tcm: keep port count until LUN teardown completes\n       {CVE-2026-80854}\n   * CVE-2026-80576\n     - drm/amdgpu: reject oversized IBs with per-ring packet limits\n       {CVE-2026-80576}\n   * CVE-2026-80843\n     - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}\n   * CVE-2026-74540\n     - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}\n   * CVE-2026-74510\n     - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}\n   * CVE-2026-68108\n     - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}\n   * CVE-2026-74283\n     - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}\n   * CVE-2026-64470\n     - Bluetooth: btusb: fix use-after-free on marvell probe failure\n       {CVE-2026-64470}\n   * CVE-2026-80783\n     - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()\n       {CVE-2026-80783}\n   * CVE-2026-72336\n     - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n       {CVE-2026-72336}\n   * CVE-2026-74637\n     - perf/core: Fix group leader use-after-free after sibling detach\n       {CVE-2026-74637}\n   * CVE-2026-72398\n     - sctp: add INIT verification after cookie unpacking {CVE-2026-72398}\n   * CVE-2026-72323\n     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}\n   * CVE-2026-72084\n     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer\n       {CVE-2026-72084}\n   * CVE-2026-80807\n     - nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807}\n   * CVE-2026-80890\n     - sctp: reject stale cookies with mismatched verification tags\n       {CVE-2026-80890}\n   * CVE-2026-80733\n     - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733}\n   * CVE-2026-80742\n     - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}\n   * CVE-2026-64550\n     - net: qualcomm: rmnet: validate MAP frame length before ingress parsing\n       {CVE-2026-64550}\n   * CVE-2026-80828\n     - ALSA: usb-audio: Complete cleanup after system-resume errors\n       {CVE-2026-80828}\n   * CVE-2026-72047\n     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit\n       {CVE-2026-72047}\n   * CVE-2026-74479\n     - net: pktgen: fix proc entry use-after-free {CVE-2026-74479}\n   * CVE-2026-80764\n     - Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764}\n   * CVE-2026-74341\n     - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response\n       {CVE-2026-74341}\n   * CVE-2026-63826\n     - fbdev: fix use-after-free in store_modes() {CVE-2026-63826}\n   * CVE-2026-80782\n     - HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed\n       {CVE-2026-80782}\n   * CVE-2026-80798\n     - nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798}\n   * CVE-2026-74649\n     - staging: rtl8723bs: fix missing shared-key auth challenge length check\n       {CVE-2026-74649}\n   * CVE-2026-68398\n     - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n       {CVE-2026-68398}\n   * CVE-2026-80907\n     - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}\n   * CVE-2026-74651\n     - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651}\n   * CVE-2026-72070\n     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()\n       {CVE-2026-72070}\n   * CVE-2026-74580\n     - vhost: reset the vring metadata cache on vring reconfiguration\n       {CVE-2026-74580}\n   * CVE-2026-64583\n     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n       {CVE-2026-64583}\n   * CVE-2026-72255\n     - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst\n       {CVE-2026-72255}\n   * CVE-2026-72374\n     - afs: Fix callback service message parsers to pass through -EAGAIN\n       {CVE-2026-72374}\n   * CVE-2026-68190\n     - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190}\n   * CVE-2026-74689\n     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}\n   * CVE-2026-80599\n     - batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599}\n   * CVE-2026-74609\n     - tipc: read le-\u003elink under the node lock in tipc_node_link_down()\n       {CVE-2026-74609}\n   * CVE-2026-68414\n     - wifi: cfg80211: cancel sched scan results work on unregister\n       {CVE-2026-68414}\n   * CVE-2026-72472\n     - nfs: use nfsi-\u003erwsem to protect traversal of the file lock list\n       {CVE-2026-72472}\n   * CVE-2026-80796\n     - nfc: nci: add data_len bound checks to activation parameter extractors\n       {CVE-2026-80796}\n   * CVE-2026-80864\n     - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp\n       {CVE-2026-80864}\n   * CVE-2026-80797\n     - nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797}\n   * CVE-2026-72085\n     - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it\n       {CVE-2026-72085}\n   * CVE-2026-74436\n     - rxrpc: serialize kernel accept preallocation with socket teardown\n       {CVE-2026-74436}\n   * CVE-2026-64582\n     - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582}\n   * CVE-2026-74641\n     - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n   * CVE-2026-74744\n     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n       {CVE-2026-74744}\n   * CVE-2026-74282\n     - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}\n   * CVE-2026-80800\n     - nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800}\n   * CVE-2026-74730\n     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call\n       {CVE-2026-74730}\n   * CVE-2026-80863\n     - RDMA/rxe: Fix OOB in free_rd_atomic_resources() {CVE-2026-80863}\n   * CVE-2026-68198\n     - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198}\n   * CVE-2026-74550\n     - net: do not send ICMP/NDISC Redirects when peer allocation fails\n       {CVE-2026-74550}\n   * CVE-2026-80785\n     - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}\n   * CVE-2026-80755\n     - selinux: reject a permission value exceeding the class permission count\n       {CVE-2026-80755}\n   * CVE-2026-68155\n     - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}\n   * CVE-2026-68160\n     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n       {CVE-2026-68160}\n   * CVE-2026-74628\n     - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628}\n   * CVE-2026-74569\n     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in\n       sip_help_tcp() {CVE-2026-74569}\n   * CVE-2026-74289\n     - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().\n       {CVE-2026-74289}\n   * CVE-2026-80908\n     - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}\n   * CVE-2026-74359\n     - configfs_lookup(): don't leave -\u003es_dentry dangling on failure\n       {CVE-2026-74359}\n   * CVE-2026-72322\n     - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}\n   * CVE-2026-74350\n     - ocfs2: validate fast symlink target during inode read {CVE-2026-74350}\n   * CVE-2026-80812\n     - ALSA: dummy: Check card index validity at probe {CVE-2026-80812}\n   * CVE-2026-68142\n     - geneve: require CAP_NET_ADMIN in the device netns for changelink\n       {CVE-2026-68142}\n   * CVE-2026-72383\n     - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}\n   * CVE-2026-80824\n     - usb: usbfs: fix use-after-free of usb_device in usbdev_release()\n       {CVE-2026-80824}\n   * CVE-2026-74387\n     - ALSA: seq: midi: Serialize output teardown with event_input\n       {CVE-2026-74387}\n   * CVE-2026-80847\n     - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}\n   * CVE-2026-80570\n     - Input: synaptics-rmi4 - zero report size on F54 work error\n       {CVE-2026-80570}\n   * CVE-2026-72476\n     - dmaengine: Fix possible use after free {CVE-2026-72476}\n   * CVE-2026-89476\n     - sctp: fix stream-\u003eoutcnt underflow on duplicate RECONF responses\n       {CVE-2026-89476}\n   * CVE-2026-89574\n     - dm array: validate array block headers on read {CVE-2026-89574}\n   * CVE-2026-89545\n     - sunrpc: defer rq_argp and rq_resp free until after RCU grace period\n       {CVE-2026-89545}\n   * CVE-2026-89462\n     - power: supply: max17040: propagate register read errors {CVE-2026-89462}\n   * CVE-2026-89733\n     - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and\n       uvc_function_unbind() {CVE-2026-89733}\n   * CVE-2026-89484\n     - lockd: fix NULL dereference on lockowner allocation failure\n       {CVE-2026-89484}\n   * CVE-2026-80996\n     - net: l2tp: do not propagate multicast notification errors {CVE-2026-80996}\n   * CVE-2026-89656\n     - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656}\n   * CVE-2026-89531\n     - svcrdma: Reject connection when transport allocation fails\n       {CVE-2026-89531}\n   * CVE-2026-89441\n     - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441}\n   * CVE-2026-89537\n     - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n       {CVE-2026-89537}\n   * CVE-2026-80976\n     - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}\n   * CVE-2026-89553\n     - nouveau/gem: reserve the bo in the info ioctl around the vma lookup\n       {CVE-2026-89553}\n   * CVE-2026-89492\n     - ocfs2: validate directory-index entry counts when reading metadata\n       {CVE-2026-89492}\n   * CVE-2026-80974\n     - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}\n   * CVE-2026-89550\n     - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}\n   * CVE-2026-89542\n     - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}\n   * CVE-2026-64014\n     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n       {CVE-2026-64014}\n   * CVE-2026-63916\n     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}\n   * CVE-2026-63892\n     - thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow\n       {CVE-2026-63892}\n   * CVE-2026-64010\n     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010}\n   * CVE-2026-63954\n     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954}\n   * CVE-2026-63927\n     - usb: dwc2: Fix use after free in debug code {CVE-2026-63927}\n   * CVE-2026-63893\n     - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()\n       {CVE-2026-63893}\n   * CVE-2026-63915\n     - nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915}\n   * CVE-2026-63904\n     - usb: usbtmc: check URB actual_length for interrupt-IN notifications\n       {CVE-2026-63904}\n   * CVE-2026-63957\n     - USB: serial: safe_serial: fix memory corruption with small endpoint\n       {CVE-2026-63957}\n   * CVE-2025-68750\n     - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}\n   * CVE-2023-54150\n     - drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}\n   * CVE-2026-63908\n     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n       {CVE-2026-63908}\n   * CVE-2026-63934\n     - iio: gyro: itg3200: fix i2c read into the wrong stack location\n       {CVE-2026-63934}\n   * CVE-2026-80819\n     - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\n       {CVE-2026-80819}\n   * CVE-2026-72234\n     - batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n       {CVE-2026-72234}\n   * CVE-2026-68357\n     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()\n       {CVE-2026-68357}\n   * CVE-2026-74588\n     - sctp: keep chunk-\u003etransport in step with the list it is queued on\n       {CVE-2026-74588}\n   * CVE-2026-68373\n     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n       {CVE-2026-68373}\n   * CVE-2026-74556\n     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection\n       buffer {CVE-2026-74556}\n   * CVE-2026-64483\n     - ALSA: firewire: isight: bound the sample count to the packet payload\n       {CVE-2026-64483}\n   * CVE-2026-63814\n     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}\n   * CVE-2026-64505\n     - usb: gadget: function: rndis: add length check for header {CVE-2026-64505}\n   * CVE-2026-72233\n     - batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233}\n   * CVE-2026-80801\n     - nfc: microread: validate target discovery payload lengths {CVE-2026-80801}\n   * CVE-2026-68121\n     - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n   * CVE-2026-74597\n     - ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n   * CVE-2026-80752\n     - Input: psxpad-spi - set driver data before use {CVE-2026-80752}\n   * CVE-2026-89555\n     - mpls: reload header after pskb_may_pull() {CVE-2026-89555}\n   * CVE-2026-89504\n     - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving\n       dangling of_node pointer {CVE-2026-89504}\n   * CVE-2026-81001\n     - slip: fix use-after-free in sl_sync() {CVE-2026-81001}\n   * CVE-2026-89569\n     - Bluetooth: RFCOMM: serialize security confirmation handling\n       {CVE-2026-89569}\n   * CVE-2026-89539\n     - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539}\n   * CVE-2026-89761\n     - apparmor: fix out-of-bounds write when null terminating a label vec\n       {CVE-2026-89761}\n   * CVE-2026-89494\n     - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494}\n   * CVE-2026-89548\n     - SUNRPC: always drain cache_cleaner before destroying a cache_detail\n       {CVE-2026-89548}\n   * CVE-2026-89478\n     - sctp: drop a chunk if its transport was removed {CVE-2026-89478}\n   * CVE-2026-89487\n     - openvswitch: only skb_tx_error() a packet we are about to drop\n       {CVE-2026-89487}\n   * CVE-2026-89477\n     - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}\n   * CVE-2026-89495\n     - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495}\n   * CVE-2026-89729\n     - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n       {CVE-2026-89729}\n   * CVE-2026-89742\n     - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742}\n   * CVE-2026-89607\n     - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n       {CVE-2026-89607}\n   * CVE-2026-80918\n     - HID: core: fix number/pointer type confusion on long items\n       {CVE-2026-80918}\n   * CVE-2026-64372\n     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n       {CVE-2026-64372}\n   * CVE-2026-64423\n     - ipv4: igmp: remove multicast group from hash table on device destruction\n       {CVE-2026-64423}\n   * CVE-2026-64323\n     - udf: validate VAT header length against the VAT inode size\n       {CVE-2026-64323}\n   * CVE-2026-64322\n     - udf: validate sparing table length as an entry count, not a byte count\n       {CVE-2026-64322}\n   * CVE-2026-64452\n     - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452}\n   * CVE-2026-64351\n     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n       {CVE-2026-64351}\n   * CVE-2026-64343\n     - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n   * CVE-2026-64318\n     - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318}\n   * CVE-2026-46208\n     - batman-adv: correct the del_timer_sync() rationale in batadv_tp_stop_all()\n       {CVE-2026-46208}\n   * CVE-2023-53039\n     - HID: intel-ish-hid: ipc: set dev-\u003edevc before the first dev_err()\n       {CVE-2023-53039}\n   * Miscellaneous upstream changes\n     - driver core: generalize driver_override in struct device\n   * Bump ABI 4.15.0-266","status":"published","published":"2026-10-13T07:29:42Z","modified":"2026-10-26T09:43:23.934683476Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791878869","title":"Fix of 274 CVEs","description":"   * CVE-2026-53091\n     - xfrm: Don't clobber inner headers when already set {CVE-2026-53091}\n     - net: account for encap headers in qdisc pkt len {CVE-2026-53091}\n   * CVE-2026-93803\n     - wifi: libipw: fix key index receive bound checks {CVE-2026-93803}\n   * CVE-2026-93286\n     - net: appletalk: fix NULL pointer dereference in aarp_send_ddp()\n       {CVE-2026-93286}\n   * CVE-2026-93280\n     - greybus: audio: bound the topology section sizes against the fetched size\n       {CVE-2026-93280}\n   * CVE-2026-93213\n     - of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}\n   * CVE-2026-93802\n     - wifi: rsi: validate beacon length before fixed buffer copy\n       {CVE-2026-93802}\n   * CVE-2026-93206\n     - PCI/proc: Use file_ns_capable() when checking config space read access\n       {CVE-2026-93206}\n   * CVE-2026-97448\n     - ACPICA: Add validation for node in acpi_ns_build_normalized_path()\n       {CVE-2026-97448}\n   * CVE-2026-97408\n     - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}\n   * CVE-2026-93268\n     - ext4: skip extra isize expansion during mount to prevent deadlock\n       {CVE-2026-93268}\n   * CVE-2026-93782\n     - vhost-scsi: flush backend after device ioctls {CVE-2026-93782}\n   * CVE-2026-93783\n     - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame\n       {CVE-2026-93783}\n   * CVE-2026-97455\n     - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n       {CVE-2026-97455}\n   * CVE-2026-93807\n     - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers\n       {CVE-2026-93807}\n   * CVE-2026-93808\n     - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}\n   * CVE-2026-89938\n     - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove\n       UAF {CVE-2026-89938}\n   * CVE-2026-89927\n     - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock\n       {CVE-2026-89927}\n   * CVE-2026-89949\n     - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}\n   * CVE-2026-89912\n     - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save\n       {CVE-2026-89912}\n   * CVE-2026-89932\n     - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}\n   * CVE-2026-89833\n     - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()\n       {CVE-2026-89833}\n   * CVE-2026-90045\n     - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}\n   * CVE-2026-89854\n     - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}\n   * CVE-2026-90015\n     - xhci: fix lost bounce buffers on TDs spanning several ring segments\n       {CVE-2026-90015}\n   * CVE-2026-89979\n     - ALSA: pcm: Fix race between non-atomic ops and trigger-start\n       {CVE-2026-89979}\n   * CVE-2026-89852\n     - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()\n       {CVE-2026-89852}\n   * CVE-2026-89861\n     - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n       {CVE-2026-89861}\n   * CVE-2026-89859\n     - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak\n       {CVE-2026-89859}\n   * CVE-2026-90036\n     - NFSD: Prevent client use-after-free during blocked-lock reaping\n       {CVE-2026-90036}\n   * CVE-2026-89987\n     - mm/huge_memory: transfer the pmd dirty bit to the folio on zap\n       {CVE-2026-89987}\n   * CVE-2026-89799\n     - bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}\n   * CVE-2026-90032\n     - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}\n   * CVE-2026-89822\n     - drm/i915: Guard against NULL driver_data in i915_pci_probe()\n       {CVE-2026-89822}\n   * CVE-2026-89929\n     - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU\n       {CVE-2026-89929}\n   * CVE-2026-89840\n     - f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}\n   * CVE-2026-89913\n     - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables\n       {CVE-2026-89913}\n   * CVE-2026-89865\n     - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers\n       {CVE-2026-89865}\n   * CVE-2026-90000\n     - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}\n   * CVE-2026-89972\n     - nvme: add missing SRCU grace period in error path {CVE-2026-89972}\n   * CVE-2026-90049\n     - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n       {CVE-2026-90049}\n   * CVE-2026-89856\n     - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation\n       {CVE-2026-89856}\n   * CVE-2026-90037\n     - NFSD: Prevent client use-after-free during close_lru reaping\n       {CVE-2026-90037}\n   * CVE-2026-89948\n     - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948}\n   * CVE-2026-90023\n     - usb: gadget: f_mass_storage: fix null pointer dereference in\n       fsg_common_set_num_buffers() {CVE-2026-90023}\n   * CVE-2026-90020\n     - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()\n       {CVE-2026-90020}\n   * CVE-2026-89838\n     - f2fs: limit recovery filename logging to stored length {CVE-2026-89838}\n   * CVE-2026-89848\n     - scsi: qla2xxx: Quiesce response IRQ before freeing request queue\n       {CVE-2026-89848}\n   * CVE-2026-90017\n     - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()\n       {CVE-2026-90017}\n   * CVE-2026-89897\n     - media: cec: Serialize exclusive follower delivery {CVE-2026-89897}\n   * CVE-2026-89877\n     - media: saa7164: fix cleanup on resource allocation failure\n       {CVE-2026-89877}\n   * CVE-2026-89952\n     - mtd: rawnand: validate ONFI extended parameter page sections\n       {CVE-2026-89952}\n   * CVE-2026-90016\n     - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}\n   * CVE-2026-89999\n     - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n       {CVE-2026-89999}\n   * CVE-2026-90044\n     - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}\n   * CVE-2026-90029\n     - usb: storage: realtek_cr: fix use-after-free on disconnect\n       {CVE-2026-90029}\n   * CVE-2026-89783\n     - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full\n       {CVE-2026-89783}\n   * CVE-2026-89778\n     - isofs: fix out-of-bounds page array access on empty zisofs block\n       {CVE-2026-89778}\n   * CVE-2026-89845\n     - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n       {CVE-2026-89845}\n   * CVE-2026-89946\n     - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946}\n   * CVE-2026-89846\n     - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n       {CVE-2026-89846}\n   * CVE-2026-89965\n     - nvdimm/btt: reject an arena whose nfree is below the lane count\n       {CVE-2026-89965}\n   * CVE-2026-89945\n     - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945}\n   * CVE-2026-89953\n     - mtd: mtdoops: free page bitmap when the backing MTD is removed\n       {CVE-2026-89953}\n   * CVE-2026-89855\n     - scsi: qla2xxx: Serialize flash version read in reset handler\n       {CVE-2026-89855}\n   * CVE-2026-89936\n     - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936}\n   * CVE-2026-90031\n     - usb-storage: ene_ub6250: fix race between scan work and probe\n       {CVE-2026-90031}\n   * CVE-2026-89901\n     - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL\n       deref {CVE-2026-89901}\n   * CVE-2026-89878\n     - media: s2255: check firmware size before reading trailing marker\n       {CVE-2026-89878}\n   * CVE-2026-89890\n     - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890}\n   * CVE-2026-89893\n     - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}\n   * CVE-2026-89951\n     - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951}\n   * CVE-2026-90034\n     - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034}\n   * CVE-2026-90033\n     - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n       {CVE-2026-90033}\n   * CVE-2026-90007\n     - scsi: pm8001: Use rollback index when freeing MSI-X vectors\n       {CVE-2026-90007}\n   * CVE-2026-90011\n     - scsi: target: iscsi: Reserve a terminator byte for the login payload\n       {CVE-2026-90011}\n   * CVE-2026-90013\n     - tracing: Take trace_array reference when opening options file\n       {CVE-2026-90013}\n   * CVE-2026-89843\n     - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak\n       {CVE-2026-89843}\n   * CVE-2026-89982\n     - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982}\n   * CVE-2026-89997\n     - dm: fix resume-vs-remove race {CVE-2026-89997}\n   * CVE-2026-90019\n     - usb: gadget: fix null pointer dereference in usb_put_function_instance()\n       {CVE-2026-90019}\n   * CVE-2026-89895\n     - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895}\n   * CVE-2026-89858\n     - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()\n       {CVE-2026-89858}\n   * CVE-2026-89864\n     - scsi: qla2xxx: Bound i2c-\u003elength in I2C bsg handlers {CVE-2026-89864}\n   * CVE-2026-89784\n     - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6\n       {CVE-2026-89784}\n   * CVE-2026-89789\n     - gtp: add synchronize_net() in gtp_newlink() error path to prevent\n       use-after-free {CVE-2026-89789}\n   * CVE-2026-89786\n     - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}\n   * CVE-2023-54047\n     - drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}\n   * CVE-2025-40146\n     - blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}\n   * CVE-2026-68367\n     - usb: gadget: f_tcm: synchronize delayed set_alt with teardown\n       {CVE-2026-68367}\n   * CVE-2026-89659\n     - NFSD: Prevent client use-after-free during delegation revoke\n       {CVE-2026-89659}\n   * CVE-2026-80841\n     - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}\n   * CVE-2026-80925\n     - vlan: fix skb_under_panic and races when toggling HW VLAN offload\n       {CVE-2026-80925}\n   * CVE-2026-64557\n     - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n       {CVE-2026-64557}\n   * CVE-2026-72390\n     - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF\n       {CVE-2026-72390}\n   * CVE-2026-80994\n     - net: openvswitch: fix flow mask use-after-free on flow deletion\n       {CVE-2026-80994}\n   * CVE-2026-74752\n     - sctp: validate cookie AUTH state before use {CVE-2026-74752}\n   * CVE-2026-68404\n     - wifi: cfg80211: use wiphy work for socket owner autodisconnect\n       {CVE-2026-68404}\n   * CVE-2026-72413\n     - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}\n   * CVE-2026-63921\n     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}\n   * CVE-2026-23050\n     - pNFS: Fix a deadlock when returning a delegation during open()\n       {CVE-2026-23050}\n   * CVE-2025-68190\n     - drm/amdgpu/atom: Check kcalloc() for WS buffer in\n       amdgpu_atom_execute_table_locked() {CVE-2025-68190}\n   * CVE-2026-63933\n     - iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933}\n   * CVE-2023-54287\n     - tty: serial: imx: disable Ageing Timer interrupt request irq\n       {CVE-2023-54287}\n   * CVE-2026-63891\n     - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n       {CVE-2026-63891}\n   * CVE-2024-50076\n     - vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}\n   * CVE-2021-47659\n     - drm/plane: Move range check for format_count earlier {CVE-2021-47659}\n   * CVE-2026-63983\n     - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}\n   * CVE-2025-68342\n     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before\n       accessing data {CVE-2025-68342}\n   * CVE-2026-63922\n     - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}\n   * CVE-2023-54007\n     - vmci_host: fix a race condition in vmci_host_poll() causing GPF\n       {CVE-2023-54007}\n   * CVE-2025-68173\n     - ftrace: Fix softlockup in ftrace_module_enable {CVE-2025-68173}\n   * CVE-2022-50864\n     - nilfs2: fix shift-out-of-bounds due to too large exponent of block size\n       {CVE-2022-50864}\n   * CVE-2026-63905\n     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n       {CVE-2026-63905}\n   * CVE-2025-40100\n     - btrfs: do not assert we found block group item when creating free space\n       tree {CVE-2025-40100}\n   * CVE-2025-40333\n     - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}\n   * CVE-2025-40160\n     - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}\n   * CVE-2026-63888\n     - scsi: target: iscsi: Fix CRC overread and double-free in\n       iscsit_handle_text_cmd() {CVE-2026-63888}\n   * CVE-2025-68778\n     - btrfs: don't log conflicting inode if it's a dir moved in the current\n       transaction {CVE-2025-68778}\n   * CVE-2023-53799\n     - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}\n   * CVE-2026-64009\n     - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}\n   * CVE-2023-54226\n     - af_unix: Fix data races around sk-\u003esk_shutdown. {CVE-2023-54226}\n   * CVE-2022-50770\n     - ocfs2: fix memory leak in ocfs2_mount_volume() {CVE-2022-50770}\n   * CVE-2022-4994\n     - KVM: x86: wean fast IN from emulator_pio_in {CVE-2022-4994}\n   * CVE-2024-50135\n     - nvme-pci: fix race condition between reset and nvme_dev_disable()\n       {CVE-2024-50135}\n   * CVE-2026-64011\n     - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}\n   * CVE-2026-80786\n     - fbdev: Wrap user-invoked calls to fb_set_var() in helper {CVE-2026-80786}\n   * CVE-2022-50774\n     - crypto: qat - fix DMA transfer direction {CVE-2022-50774}\n   * CVE-2023-53834\n     - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match\n       {CVE-2023-53834}\n   * CVE-2026-74444\n     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n       {CVE-2026-74444}\n   * CVE-2022-50764\n     - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}\n   * CVE-2026-80794\n     - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers\n       {CVE-2026-80794}\n   * CVE-2026-80854\n     - usb: gadget: f_tcm: keep port count until LUN teardown completes\n       {CVE-2026-80854}\n   * CVE-2026-80576\n     - drm/amdgpu: reject oversized IBs with per-ring packet limits\n       {CVE-2026-80576}\n   * CVE-2026-80843\n     - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}\n   * CVE-2026-74540\n     - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}\n   * CVE-2026-74510\n     - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}\n   * CVE-2026-68108\n     - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}\n   * CVE-2026-74283\n     - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}\n   * CVE-2026-64470\n     - Bluetooth: btusb: fix use-after-free on marvell probe failure\n       {CVE-2026-64470}\n   * CVE-2026-80783\n     - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()\n       {CVE-2026-80783}\n   * CVE-2026-72336\n     - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n       {CVE-2026-72336}\n   * CVE-2026-74637\n     - perf/core: Fix group leader use-after-free after sibling detach\n       {CVE-2026-74637}\n   * CVE-2026-72398\n     - sctp: add INIT verification after cookie unpacking {CVE-2026-72398}\n   * CVE-2026-72323\n     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}\n   * CVE-2026-72084\n     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer\n       {CVE-2026-72084}\n   * CVE-2026-80807\n     - nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807}\n   * CVE-2026-80890\n     - sctp: reject stale cookies with mismatched verification tags\n       {CVE-2026-80890}\n   * CVE-2026-80733\n     - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733}\n   * CVE-2026-80742\n     - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}\n   * CVE-2026-64550\n     - net: qualcomm: rmnet: validate MAP frame length before ingress parsing\n       {CVE-2026-64550}\n   * CVE-2026-80828\n     - ALSA: usb-audio: Complete cleanup after system-resume errors\n       {CVE-2026-80828}\n   * CVE-2026-72047\n     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit\n       {CVE-2026-72047}\n   * CVE-2026-74479\n     - net: pktgen: fix proc entry use-after-free {CVE-2026-74479}\n   * CVE-2026-80764\n     - Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764}\n   * CVE-2026-74341\n     - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response\n       {CVE-2026-74341}\n   * CVE-2026-63826\n     - fbdev: fix use-after-free in store_modes() {CVE-2026-63826}\n   * CVE-2026-80782\n     - HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed\n       {CVE-2026-80782}\n   * CVE-2026-80798\n     - nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798}\n   * CVE-2026-74649\n     - staging: rtl8723bs: fix missing shared-key auth challenge length check\n       {CVE-2026-74649}\n   * CVE-2026-68398\n     - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n       {CVE-2026-68398}\n   * CVE-2026-80907\n     - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}\n   * CVE-2026-74651\n     - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651}\n   * CVE-2026-72070\n     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()\n       {CVE-2026-72070}\n   * CVE-2026-74580\n     - vhost: reset the vring metadata cache on vring reconfiguration\n       {CVE-2026-74580}\n   * CVE-2026-64583\n     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n       {CVE-2026-64583}\n   * CVE-2026-72255\n     - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst\n       {CVE-2026-72255}\n   * CVE-2026-72374\n     - afs: Fix callback service message parsers to pass through -EAGAIN\n       {CVE-2026-72374}\n   * CVE-2026-68190\n     - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190}\n   * CVE-2026-74689\n     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}\n   * CVE-2026-80599\n     - batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599}\n   * CVE-2026-74609\n     - tipc: read le-\u003elink under the node lock in tipc_node_link_down()\n       {CVE-2026-74609}\n   * CVE-2026-68414\n     - wifi: cfg80211: cancel sched scan results work on unregister\n       {CVE-2026-68414}\n   * CVE-2026-72472\n     - nfs: use nfsi-\u003erwsem to protect traversal of the file lock list\n       {CVE-2026-72472}\n   * CVE-2026-80796\n     - nfc: nci: add data_len bound checks to activation parameter extractors\n       {CVE-2026-80796}\n   * CVE-2026-80864\n     - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp\n       {CVE-2026-80864}\n   * CVE-2026-80797\n     - nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797}\n   * CVE-2026-72085\n     - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it\n       {CVE-2026-72085}\n   * CVE-2026-74436\n     - rxrpc: serialize kernel accept preallocation with socket teardown\n       {CVE-2026-74436}\n   * CVE-2026-64582\n     - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582}\n   * CVE-2026-74641\n     - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n   * CVE-2026-74744\n     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n       {CVE-2026-74744}\n   * CVE-2026-74282\n     - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}\n   * CVE-2026-80800\n     - nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800}\n   * CVE-2026-74730\n     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call\n       {CVE-2026-74730}\n   * CVE-2026-80863\n     - RDMA/rxe: Fix OOB in free_rd_atomic_resources() {CVE-2026-80863}\n   * CVE-2026-68198\n     - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198}\n   * CVE-2026-74550\n     - net: do not send ICMP/NDISC Redirects when peer allocation fails\n       {CVE-2026-74550}\n   * CVE-2026-80785\n     - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}\n   * CVE-2026-80755\n     - selinux: reject a permission value exceeding the class permission count\n       {CVE-2026-80755}\n   * CVE-2026-68155\n     - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}\n   * CVE-2026-68160\n     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n       {CVE-2026-68160}\n   * CVE-2026-74628\n     - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628}\n   * CVE-2026-74569\n     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in\n       sip_help_tcp() {CVE-2026-74569}\n   * CVE-2026-74289\n     - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().\n       {CVE-2026-74289}\n   * CVE-2026-80908\n     - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}\n   * CVE-2026-74359\n     - configfs_lookup(): don't leave -\u003es_dentry dangling on failure\n       {CVE-2026-74359}\n   * CVE-2026-72322\n     - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}\n   * CVE-2026-74350\n     - ocfs2: validate fast symlink target during inode read {CVE-2026-74350}\n   * CVE-2026-80812\n     - ALSA: dummy: Check card index validity at probe {CVE-2026-80812}\n   * CVE-2026-68142\n     - geneve: require CAP_NET_ADMIN in the device netns for changelink\n       {CVE-2026-68142}\n   * CVE-2026-72383\n     - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}\n   * CVE-2026-80824\n     - usb: usbfs: fix use-after-free of usb_device in usbdev_release()\n       {CVE-2026-80824}\n   * CVE-2026-74387\n     - ALSA: seq: midi: Serialize output teardown with event_input\n       {CVE-2026-74387}\n   * CVE-2026-80847\n     - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}\n   * CVE-2026-80570\n     - Input: synaptics-rmi4 - zero report size on F54 work error\n       {CVE-2026-80570}\n   * CVE-2026-72476\n     - dmaengine: Fix possible use after free {CVE-2026-72476}\n   * CVE-2026-89476\n     - sctp: fix stream-\u003eoutcnt underflow on duplicate RECONF responses\n       {CVE-2026-89476}\n   * CVE-2026-89574\n     - dm array: validate array block headers on read {CVE-2026-89574}\n   * CVE-2026-89545\n     - sunrpc: defer rq_argp and rq_resp free until after RCU grace period\n       {CVE-2026-89545}\n   * CVE-2026-89462\n     - power: supply: max17040: propagate register read errors {CVE-2026-89462}\n   * CVE-2026-89733\n     - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and\n       uvc_function_unbind() {CVE-2026-89733}\n   * CVE-2026-89484\n     - lockd: fix NULL dereference on lockowner allocation failure\n       {CVE-2026-89484}\n   * CVE-2026-80996\n     - net: l2tp: do not propagate multicast notification errors {CVE-2026-80996}\n   * CVE-2026-89656\n     - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656}\n   * CVE-2026-89531\n     - svcrdma: Reject connection when transport allocation fails\n       {CVE-2026-89531}\n   * CVE-2026-89441\n     - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441}\n   * CVE-2026-89537\n     - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n       {CVE-2026-89537}\n   * CVE-2026-80976\n     - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}\n   * CVE-2026-89553\n     - nouveau/gem: reserve the bo in the info ioctl around the vma lookup\n       {CVE-2026-89553}\n   * CVE-2026-89492\n     - ocfs2: validate directory-index entry counts when reading metadata\n       {CVE-2026-89492}\n   * CVE-2026-80974\n     - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}\n   * CVE-2026-89550\n     - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}\n   * CVE-2026-89542\n     - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}\n   * CVE-2026-64014\n     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n       {CVE-2026-64014}\n   * CVE-2026-63916\n     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}\n   * CVE-2026-63892\n     - thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow\n       {CVE-2026-63892}\n   * CVE-2026-64010\n     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010}\n   * CVE-2026-63954\n     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954}\n   * CVE-2026-63927\n     - usb: dwc2: Fix use after free in debug code {CVE-2026-63927}\n   * CVE-2026-63893\n     - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()\n       {CVE-2026-63893}\n   * CVE-2026-63915\n     - nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915}\n   * CVE-2026-63904\n     - usb: usbtmc: check URB actual_length for interrupt-IN notifications\n       {CVE-2026-63904}\n   * CVE-2026-63957\n     - USB: serial: safe_serial: fix memory corruption with small endpoint\n       {CVE-2026-63957}\n   * CVE-2025-68750\n     - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}\n   * CVE-2023-54150\n     - drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}\n   * CVE-2026-63908\n     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n       {CVE-2026-63908}\n   * CVE-2026-63934\n     - iio: gyro: itg3200: fix i2c read into the wrong stack location\n       {CVE-2026-63934}\n   * CVE-2026-80819\n     - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\n       {CVE-2026-80819}\n   * CVE-2026-72234\n     - batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n       {CVE-2026-72234}\n   * CVE-2026-68357\n     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()\n       {CVE-2026-68357}\n   * CVE-2026-74588\n     - sctp: keep chunk-\u003etransport in step with the list it is queued on\n       {CVE-2026-74588}\n   * CVE-2026-68373\n     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n       {CVE-2026-68373}\n   * CVE-2026-74556\n     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection\n       buffer {CVE-2026-74556}\n   * CVE-2026-64483\n     - ALSA: firewire: isight: bound the sample count to the packet payload\n       {CVE-2026-64483}\n   * CVE-2026-63814\n     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}\n   * CVE-2026-64505\n     - usb: gadget: function: rndis: add length check for header {CVE-2026-64505}\n   * CVE-2026-72233\n     - batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233}\n   * CVE-2026-80801\n     - nfc: microread: validate target discovery payload lengths {CVE-2026-80801}\n   * CVE-2026-68121\n     - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n   * CVE-2026-74597\n     - ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n   * CVE-2026-80752\n     - Input: psxpad-spi - set driver data before use {CVE-2026-80752}\n   * CVE-2026-89555\n     - mpls: reload header after pskb_may_pull() {CVE-2026-89555}\n   * CVE-2026-89504\n     - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving\n       dangling of_node pointer {CVE-2026-89504}\n   * CVE-2026-81001\n     - slip: fix use-after-free in sl_sync() {CVE-2026-81001}\n   * CVE-2026-89569\n     - Bluetooth: RFCOMM: serialize security confirmation handling\n       {CVE-2026-89569}\n   * CVE-2026-89539\n     - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539}\n   * CVE-2026-89761\n     - apparmor: fix out-of-bounds write when null terminating a label vec\n       {CVE-2026-89761}\n   * CVE-2026-89494\n     - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494}\n   * CVE-2026-89548\n     - SUNRPC: always drain cache_cleaner before destroying a cache_detail\n       {CVE-2026-89548}\n   * CVE-2026-89478\n     - sctp: drop a chunk if its transport was removed {CVE-2026-89478}\n   * CVE-2026-89487\n     - openvswitch: only skb_tx_error() a packet we are about to drop\n       {CVE-2026-89487}\n   * CVE-2026-89477\n     - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}\n   * CVE-2026-89495\n     - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495}\n   * CVE-2026-89729\n     - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n       {CVE-2026-89729}\n   * CVE-2026-89742\n     - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742}\n   * CVE-2026-89607\n     - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n       {CVE-2026-89607}\n   * CVE-2026-80918\n     - HID: core: fix number/pointer type confusion on long items\n       {CVE-2026-80918}\n   * CVE-2026-64372\n     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n       {CVE-2026-64372}\n   * CVE-2026-64423\n     - ipv4: igmp: remove multicast group from hash table on device destruction\n       {CVE-2026-64423}\n   * CVE-2026-64323\n     - udf: validate VAT header length against the VAT inode size\n       {CVE-2026-64323}\n   * CVE-2026-64322\n     - udf: validate sparing table length as an entry count, not a byte count\n       {CVE-2026-64322}\n   * CVE-2026-64452\n     - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452}\n   * CVE-2026-64351\n     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n       {CVE-2026-64351}\n   * CVE-2026-64343\n     - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n   * CVE-2026-64318\n     - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318}\n   * CVE-2026-46208\n     - batman-adv: correct the del_timer_sync() rationale in batadv_tp_stop_all()\n       {CVE-2026-46208}\n   * CVE-2023-53039\n     - HID: intel-ish-hid: ipc: set dev-\u003edevc before the first dev_err()\n       {CVE-2023-53039}\n   * Miscellaneous upstream changes\n     - driver core: generalize driver_override in struct device\n   * Bump ABI 4.15.0-266","status":"published","published":"2026-10-21T23:59:33Z","modified":"2026-10-26T09:43:39.657580087Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791946572","title":"Fix of 198 CVEs","description":"   * CVE-2024-36894\n     - usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in\n       ffs_user_copy_worker() {CVE-2024-36894}\n   * CVE-2026-97447\n     - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()\n       {CVE-2026-97447}\n   * CVE-2026-93822\n     - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}\n   * CVE-2026-93826\n     - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}\n   * CVE-2026-97954\n     - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}\n   * CVE-2026-97949\n     - configfs: unhash the dentry before dropping the item in rmdir\n       {CVE-2026-97949}\n   * CVE-2026-97931\n     - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}\n   * CVE-2026-97940\n     - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}\n   * CVE-2026-97539\n     - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}\n   * CVE-2026-74510\n     - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}\n   * CVE-2026-72084\n     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer\n       {CVE-2026-72084}\n   * CVE-2026-90302\n     - ocfs2: synchronize heartbeat callbacks with o2net teardown\n       {CVE-2026-90302}\n   * CVE-2026-90320\n     - ocfs2: validate external xattr entries when reading metadata\n       {CVE-2026-90320}\n   * CVE-2026-90321\n     - ocfs2: validate inline xattrs during inode block validation\n       {CVE-2026-90321}\n   * CVE-2026-90431\n     - remoteproc: Prevent crash handling to race with rproc_del()\n       {CVE-2026-90431}\n   * CVE-2026-74637\n     - perf/core: Fix group leader use-after-free after sibling detach\n       {CVE-2026-74637}\n   * CVE-2026-74752\n     - sctp: validate cookie AUTH state before use {CVE-2026-74752}\n   * CVE-2026-74387\n     - ALSA: seq: midi: Serialize output teardown with event_input\n       {CVE-2026-74387}\n   * CVE-2026-80536\n     - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}\n   * CVE-2026-89659\n     - NFSD: Prevent client use-after-free during delegation revoke\n       {CVE-2026-89659}\n   * CVE-2026-80576\n     - drm/amdgpu: reject oversized IBs with per-ring packet limits\n       {CVE-2026-80576}\n   * CVE-2026-90223\n     - nfc: llcp: bound SNL TLV parsing to the skb and add length checks\n       {CVE-2026-90223}\n   * CVE-2026-80994\n     - net: openvswitch: fix flow mask use-after-free on flow deletion\n       {CVE-2026-80994}\n   * CVE-2026-72398\n     - sctp: add INIT verification after cookie unpacking {CVE-2026-72398}\n   * CVE-2026-74583\n     - net/sched: cls_route: fix fastmap use-after-free on filter\n       {CVE-2026-74583}\n   * CVE-2026-72322\n     - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}\n   * CVE-2026-93095\n     - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}\n   * CVE-2026-72472\n     - nfs: use nfsi-\u003erwsem to protect traversal of the file lock list\n       {CVE-2026-72472}\n   * CVE-2026-90045\n     - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}\n   * CVE-2026-90421\n     - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}\n   * CVE-2026-64583\n     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n       {CVE-2026-64583}\n   * CVE-2026-68329\n     - iommu/amd: Wait for completion instead of returning early in\n       iommu_completion_wait() {CVE-2026-68329}\n   * CVE-2026-89448\n     - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}\n   * CVE-2026-64001\n     - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}\n   * CVE-2026-64305\n     - crypto: qat - protect service table iterations with service_lock\n       {CVE-2026-64305}\n   * CVE-2026-64348\n     - usb: free iso schedules on failed submit {CVE-2026-64348}\n   * CVE-2026-64422\n     - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes\n       {CVE-2026-64422}\n   * CVE-2026-90180\n     - block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180}\n   * CVE-2026-90057\n     - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n       {CVE-2026-90057}\n   * CVE-2026-89854\n     - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}\n   * CVE-2026-90103\n     - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}\n   * CVE-2026-89574\n     - dm array: validate array block headers on read {CVE-2026-89574}\n   * CVE-2026-90433\n     - spi: oc-tiny: switch to managed controller allocation {CVE-2026-90433}\n   * CVE-2026-74628\n     - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628}\n   * CVE-2026-89549\n     - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}\n   * CVE-2026-74350\n     - ocfs2: validate fast symlink target during inode read {CVE-2026-74350}\n   * CVE-2026-89637\n     - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed\n       secondary T2 {CVE-2026-89637}\n   * CVE-2026-89633\n     - smb: client: fix OOB read/write from unvalidated DataOffset in\n       coalesce_t2() {CVE-2026-89633}\n   * CVE-2026-89610\n     - ntfs: verify run length exceeding volume boundary {CVE-2026-89610}\n   * CVE-2026-72171\n     - mtd: slram: remove failed entries from the device list {CVE-2026-72171}\n   * CVE-2026-72323\n     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}\n   * CVE-2026-89932\n     - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}\n   * CVE-2026-89475\n     - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475}\n   * CVE-2026-68108\n     - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}\n   * CVE-2026-89671\n     - nfsd: gate nfs3 setacl by argp-\u003emask {CVE-2026-89671}\n   * CVE-2026-64009\n     - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}\n   * CVE-2026-93117\n     - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}\n   * CVE-2026-74609\n     - tipc: read le-\u003elink under the node lock in tipc_node_link_down()\n       {CVE-2026-74609}\n   * CVE-2026-74689\n     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}\n   * CVE-2026-89545\n     - sunrpc: defer rq_argp and rq_resp free until after RCU grace period\n       {CVE-2026-89545}\n   * CVE-2026-74283\n     - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}\n   * CVE-2026-90032\n     - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}\n   * CVE-2026-64471\n     - Bluetooth: btusb: fix use-after-free on registration failure\n       {CVE-2026-64471}\n   * CVE-2026-81001\n     - slip: fix use-after-free in sl_sync() {CVE-2026-81001}\n   * CVE-2026-89553\n     - nouveau/gem: reserve the bo in the info ioctl around the vma lookup\n       {CVE-2026-89553}\n   * CVE-2026-63826\n     - fbdev: fix use-after-free in store_modes() {CVE-2026-63826}\n   * CVE-2026-74444\n     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n       {CVE-2026-74444}\n   * CVE-2026-68093\n     - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after\n       hotplug {CVE-2026-68093}\n   * CVE-2026-89965\n     - nvdimm/btt: reject an arena whose nfree is below the lane count\n       {CVE-2026-89965}\n   * CVE-2026-64546\n     - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}\n   * CVE-2026-93189\n     - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free\n       {CVE-2026-93189}\n   * CVE-2026-89733\n     - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and\n       uvc_function_unbind() {CVE-2026-89733}\n   * CVE-2026-89548\n     - SUNRPC: always drain cache_cleaner before destroying a cache_detail\n       {CVE-2026-89548}\n   * CVE-2026-72389\n     - bridge: stp: Fix a potential use-after-free when deleting a bridge\n       {CVE-2026-72389}\n   * CVE-2026-89778\n     - isofs: fix out-of-bounds page array access on empty zisofs block\n       {CVE-2026-89778}\n   * CVE-2026-63888\n     - scsi: target: iscsi: Fix CRC overread and double-free in\n       iscsit_handle_text_cmd() {CVE-2026-63888}\n   * CVE-2026-72413\n     - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}\n   * CVE-2026-74730\n     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call\n       {CVE-2026-74730}\n   * CVE-2026-80558\n     - libceph: Avoid using invalid osd indices from primary_temp\n       {CVE-2026-80558}\n   * CVE-2026-74641\n     - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n   * CVE-2026-90044\n     - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}\n   * CVE-2026-74479\n     - net: pktgen: fix proc entry use-after-free {CVE-2026-74479}\n   * CVE-2026-74630\n     - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n   * CVE-2026-74744\n     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n       {CVE-2026-74744}\n   * CVE-2026-74505\n     - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}\n   * CVE-2026-89699\n     - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}\n   * CVE-2026-72070\n     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()\n       {CVE-2026-72070}\n   * CVE-2026-90329\n     - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}\n   * CVE-2026-89550\n     - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}\n   * CVE-2026-89542\n     - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}\n   * CVE-2026-72383\n     - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}\n   * CVE-2026-89537\n     - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n       {CVE-2026-89537}\n   * CVE-2026-74359\n     - configfs_lookup(): don't leave -\u003es_dentry dangling on failure\n       {CVE-2026-74359}\n   * CVE-2026-68376\n     - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n   * CVE-2026-68320\n     - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid\n       {CVE-2026-68320}\n   * CVE-2026-68155\n     - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}\n   * CVE-2026-68198\n     - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198}\n   * CVE-2026-80681\n     - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}\n   * CVE-2026-74669\n     - ipvs: clear IPv4 options after rebasing tunnel ICMP errors\n       {CVE-2026-74669}\n   * CVE-2026-68414\n     - wifi: cfg80211: cancel sched scan results work on unregister\n       {CVE-2026-68414}\n   * CVE-2026-68373\n     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n       {CVE-2026-68373}\n   * CVE-2026-89469\n     - power: supply: lp8727: fix use-after-free in lp8727_release_irq()\n       {CVE-2026-89469}\n   * CVE-2026-64449\n     - staging: vme_user: bound slave read/write to the kern_buf size\n       {CVE-2026-64449}\n   * CVE-2026-90013\n     - tracing: Take trace_array reference when opening options file\n       {CVE-2026-90013}\n   * CVE-2026-90204\n     - ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204}\n   * CVE-2026-90205\n     - ocfs2: validate orphan slot during inode read {CVE-2026-90205}\n   * CVE-2026-90000\n     - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}\n   * CVE-2026-90037\n     - NFSD: Prevent client use-after-free during close_lru reaping\n       {CVE-2026-90037}\n   * CVE-2026-63922\n     - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}\n   * CVE-2026-64011\n     - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}\n   * CVE-2026-72234\n     - batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n       {CVE-2026-72234}\n   * CVE-2026-74587\n     - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}\n   * CVE-2026-74688\n     - sctp: clear control chunk transport if it is being removed\n       {CVE-2026-74688}\n   * CVE-2026-68160\n     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n       {CVE-2026-68160}\n   * CVE-2026-74569\n     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in\n       sip_help_tcp() {CVE-2026-74569}\n   * CVE-2026-68199\n     - wifi: ath6kl: fix OOB access from firmware ADDBA window size\n       {CVE-2026-68199}\n   * CVE-2026-89487\n     - openvswitch: only skb_tx_error() a packet we are about to drop\n       {CVE-2026-89487}\n   * CVE-2026-80928\n     - smack: fix cred UAF in smack_file_send_sigiotask() {CVE-2026-80928}\n   * CVE-2026-64424\n     - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}\n   * CVE-2026-64363\n     - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363}\n   * CVE-2026-64343\n     - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n   * CVE-2026-64341\n     - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}\n   * CVE-2026-64340\n     - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}\n   * CVE-2026-64344\n     - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n   * CVE-2026-90203\n     - Squashfs: check block offset is not negative {CVE-2026-90203}\n   * CVE-2026-92498\n     - wifi: ath6kl: avoid buffer overreads in WMI event handlers\n       {CVE-2026-92498}\n   * CVE-2026-90334\n     - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}\n   * CVE-2026-89890\n     - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890}\n   * CVE-2026-89893\n     - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}\n   * CVE-2026-90033\n     - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n       {CVE-2026-90033}\n   * CVE-2026-90011\n     - scsi: target: iscsi: Reserve a terminator byte for the login payload\n       {CVE-2026-90011}\n   * CVE-2025-68324\n     - scsi: imm: Fix use-after-free bug caused by unfinished delayed work\n       {CVE-2025-68324}\n   * CVE-2026-89786\n     - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}\n   * CVE-2026-74588\n     - sctp: keep chunk-\u003etransport in step with the list it is queued on\n       {CVE-2026-74588}\n   * CVE-2026-74556\n     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection\n       buffer {CVE-2026-74556}\n   * CVE-2026-64483\n     - ALSA: firewire: isight: bound the sample count to the packet payload\n       {CVE-2026-64483}\n   * CVE-2026-63814\n     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}\n   * CVE-2026-64505\n     - usb: gadget: function: rndis: add length check for header {CVE-2026-64505}\n   * CVE-2026-68121\n     - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n   * CVE-2026-74597\n     - ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err() {CVE-2026-74597}\n   * CVE-2026-68140\n     - net/iucv: fix use-after-free of a severed iucv_path {CVE-2026-68140}\n   * CVE-2026-74499\n     - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n       {CVE-2026-74499}\n   * CVE-2026-74498\n     - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set\n       {CVE-2026-74498}\n   * CVE-2026-72226\n     - batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226}\n   * CVE-2026-74255\n     - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255}\n   * CVE-2026-64504\n     - iio: accel: bmc150: clamp the device-reported FIFO frame count\n       {CVE-2026-64504}\n   * CVE-2026-72351\n     - gue: validate REMCSUM private option length {CVE-2026-72351}\n   * CVE-2026-68144\n     - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}\n   * CVE-2026-80601\n     - batman-adv: gw: acquire ethernet header only after skb realloc\n       {CVE-2026-80601}\n   * CVE-2026-68202\n     - ALSA: seq: close a re-opened queue timer in the destructor\n       {CVE-2026-68202}\n   * CVE-2026-74679\n     - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679}\n   * CVE-2026-68153\n     - libceph: remove debugfs files before client teardown {CVE-2026-68153}\n   * CVE-2026-68143\n     - net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n   * CVE-2026-68397\n     - net/iucv: take a reference on the socket found in afiucv_hs_rcv()\n       {CVE-2026-68397}\n   * CVE-2026-72406\n     - net: sungem: fix probe error cleanup {CVE-2026-72406}\n   * CVE-2026-72014\n     - drbd: reject data replies with an out-of-range payload size\n       {CVE-2026-72014}\n   * CVE-2026-68141\n     - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() {CVE-2026-68141}\n   * CVE-2026-74408\n     - wifi: ath9k: fix OOB access from firmware tx status queue ID\n       {CVE-2026-74408}\n   * CVE-2026-80622\n     - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}\n   * CVE-2026-68363\n     - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware\n       request {CVE-2026-68363}\n   * CVE-2026-68188\n     - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}\n   * CVE-2026-68474\n     - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()\n       {CVE-2026-68474}\n   * CVE-2026-89723\n     - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation\n       {CVE-2026-89723}\n   * CVE-2026-89575\n     - dm raid1: reserve space for NUL-terminator in build_constructor_string()\n       {CVE-2026-89575}\n   * CVE-2026-89504\n     - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving\n       dangling of_node pointer {CVE-2026-89504}\n   * CVE-2026-89494\n     - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494}\n   * CVE-2026-89478\n     - sctp: drop a chunk if its transport was removed {CVE-2026-89478}\n   * CVE-2026-81003\n     - net/iucv: filter frames in afiucv_hs_rcv() by ingress device\n       {CVE-2026-81003}\n   * CVE-2026-89495\n     - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495}\n   * CVE-2026-89607\n     - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n       {CVE-2026-89607}\n   * CVE-2026-64372\n     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n       {CVE-2026-64372}\n   * CVE-2026-64423\n     - ipv4: igmp: remove multicast group from hash table on device destruction\n       {CVE-2026-64423}\n   * CVE-2026-64322\n     - udf: validate sparing table length as an entry count, not a byte count\n       {CVE-2026-64322}\n   * CVE-2022-50401\n     - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure\n       {CVE-2022-50401}\n   * CVE-2026-64452\n     - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452}\n   * CVE-2026-64351\n     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n       {CVE-2026-64351}\n   * CVE-2026-64342\n     - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}\n   * CVE-2026-64318\n     - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318}\n   * CVE-2026-64109\n     - af_unix: read the receive queue tail length under the queue lock in\n       unix_stream_data_wait() {CVE-2026-64109}\n   * CVE-2026-68156\n     - libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n       {CVE-2026-68156}\n   * CVE-2026-23455\n     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()\n       {CVE-2026-23455}\n   * CVE-2026-64115\n     - vsock/vmci: fix UAF when peer resets connection during handshake\n       {CVE-2026-64115}\n   * CVE-2026-64114\n     - ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 {CVE-2026-64114}\n   * CVE-2026-64096\n     - batman-adv: mcast: fix use-after-free in orig_node RCU release\n       {CVE-2026-64096}\n   * CVE-2026-64237\n     - Input: elan_i2c - validate firmware size before use {CVE-2026-64237}\n   * CVE-2026-64113\n     - ixgbevf: fix use-after-free in VEPA multicast source pruning\n       {CVE-2026-64113}\n   * CVE-2026-64103\n     - scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}\n   * CVE-2026-64298\n     - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n       {CVE-2026-64298}\n   * CVE-2026-64266\n     - fuse: re-lock request before returning from fuse_ref_folio()\n       {CVE-2026-64266}\n   * CVE-2026-64271\n     - Input: touchwin - reset the packet index on every complete packet\n       {CVE-2026-64271}\n   * CVE-2026-64270\n     - Input: mms114 - reject an oversized device packet size {CVE-2026-64270}\n   * CVE-2026-64274\n     - Input: goodix - clamp the device-reported contact count {CVE-2026-64274}\n   * CVE-2026-64273\n     - Input: iforce - bound the device-reported force-feedback effect index\n       {CVE-2026-64273}\n   * CVE-2026-52942\n     - netfilter: nf_log: validate MAC header was set before dumping it\n       {CVE-2026-52942}\n   * CVE-2026-46056\n     - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers\n       {CVE-2026-46056}\n   * CVE-2026-53270\n     - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}\n   * CVE-2025-71073\n     - Input: lkkbd - disable pending work before freeing device {CVE-2025-71073}\n   * CVE-2019-19377\n     - btrfs: Don't submit any btree write bio if the fs has errors\n       {CVE-2019-19377}\n   * Bump ABI 4.4.0-288","status":"published","published":"2026-10-14T02:59:10Z","modified":"2026-10-26T09:43:45.501442967Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792243729","title":"kernel: Fix of 53 CVEs","description":"- ipv4: validate checksum_start before completing checksum {CVE-2026-99999}\n- vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}\n- af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() {CVE-2026-64109}\n- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}\n- tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}\n- Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}\n- dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}\n- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}\n- drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}\n- nfsd: make sure exp active before svc_export_show {CVE-2024-56558}\n- USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}\n- ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}\n- geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}\n- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}\n- drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}\n- RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}\n- netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}\n- net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}\n- RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}\n- wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}\n- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}\n- mm/khugepaged: fix -\u003eanon_vma race {CVE-2023-52935}\n- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}\n- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}\n- drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}\n- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}\n- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}\n- xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}\n- Squashfs: check block offset is not negative {CVE-2026-90203}\n- tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}\n- uio: Fix stale info pointer in failed registration path {CVE-2026-93054}\n- md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}\n- net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}\n- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n- ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}\n- sctp: validate cookie AUTH state before use {CVE-2026-74752}\n- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}\n- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}\n- tipc: read le-\u003elink under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}\n- libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}\n- nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}\n- isdn: cpai: check ctr-\u003ecnr to avoid array index out of bound {CVE-2021-4439}\n- igbvf: fix double free in `igbvf_probe` {CVE-2021-47589}\n- scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565}\n- drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}","status":"published","published":"2026-10-17T15:34:24Z","modified":"2026-10-26T09:43:54.281748239Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792247642","title":"kernel: Fix of 50 CVEs","description":"- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}\n- ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}\n- tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}\n- netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}\n- mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}\n- ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}\n- Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}\n- net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}\n- vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}\n- af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() {CVE-2026-64109}\n- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}\n- tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}\n- dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}\n- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}\n- ipv4: validate checksum_start before completing checksum {CVE-2026-99999}\n- drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}\n- nfsd: make sure exp active before svc_export_show {CVE-2024-56558}\n- USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}\n- ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}\n- geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}\n- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}\n- RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}\n- RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}\n- wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}\n- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}\n- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}\n- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}\n- drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}\n- dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}\n- net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}\n- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}\n- xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}\n- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}\n- Squashfs: check block offset is not negative {CVE-2026-90203}\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}\n- uio: Fix stale info pointer in failed registration path {CVE-2026-93054}\n- md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}\n- tipc: read le-\u003elink under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}\n- libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}\n- nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}\n- ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}","status":"published","published":"2026-10-17T14:35:01Z","modified":"2026-10-26T09:43:29.981332488Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"MGASA-2026-0506","title":"Updated kernel, drakx-installer-images, kmod-nvidia-current-wopengpu, kmod-xtables-addons \u0026 kmod-virtualbox packages fix Security Vulnerabilities","description":"Upstream kernel 6.18.55 version fixes bugs and vulnerabilities.\nThe kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu \u0026\ndrakx-installer-images packages have been updated to work with this new\nkernel.\n","status":"published","published":"2026-10-15T05:34:04Z","modified":"2026-10-15T05:45:03.401041509Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0542","title":"Updated kernel-linus packages fix security vulnerabilities","description":"Vanilla upstream kernel version 6.18.55 fixes vulnerabilities.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2026-10-25T02:36:50Z","modified":"2026-10-25T02:45:03.29833395Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22091-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T15:44:43Z","modified":"2026-10-19T17:23:14.488875612Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24179-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:24:33Z","modified":"2026-10-20T17:23:58.081470941Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24181-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure (bsc#1274010).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow (bsc#1275156).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc (\"Disable CONFIG_BATMAN_ADV (jsc#PED-16892)\").\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T15:51:36Z","modified":"2026-10-20T17:23:58.081294417Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24182-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure (bsc#1274010).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow (bsc#1275156).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T14:42:54Z","modified":"2026-10-20T17:23:58.082704471Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24184-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:51:59Z","modified":"2026-10-20T17:24:00.253930144Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24197-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T14:15:17Z","modified":"2026-10-21T17:23:09.534105524Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24235-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:51:59Z","modified":"2026-10-21T17:23:12.046754854Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24315-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure (bsc#1274010).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow (bsc#1275156).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc (\"Disable CONFIG_BATMAN_ADV (jsc#PED-16892)\").\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T16:13:17Z","modified":"2026-10-27T17:23:13.4159637Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24316-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure (bsc#1274010).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow (bsc#1275156).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T16:39:36Z","modified":"2026-10-27T17:23:13.475564625Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4640-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72125: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER (bsc#1277535).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74533: replace additional lock in hci_conn with a common spinlock (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74551: hwmon: (nzxt-smart2) DMA-align output buffer (bsc#1275680).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80947: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (bsc#1280239).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90047: drm/xe: Don't hand out the flat CCS storage as usable VRAM (bsc#1280927).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Fix potential NULL pointer dereference (bsc#1283130).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices (git-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: Propagate write errors in generic mixer put callbacks (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ('Disable CONFIG_BATMAN_ADV (jsc#PED-16892)').\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- drm: rz-du: Ensure correct suspend/resume ordering with VSP (stable-fixes).\n- EDAC/amd64: Add support for AMD family 1Ah-based newer models (jsc#PED-16968).\n- EDAC/mc_sysfs: Increase legacy channel support to 16 (jsc#PED-16968).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (jsc#PED-16854).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: s390: pci: Fix aisb calculation (bsc#1277451).\n- KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (bsc#1277451).\n- KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (bsc#1277451).\n- KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1277451).\n- KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (bsc#1277451).\n- KVM: s390: pci: Fix missing error codes and memory unaccounting (bsc#1277451).\n- KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277451).\n- KVM: s390: pci: Fix resource leak on IRQ registration failure (bsc#1277451).\n- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1277451).\n- KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (bsc#1277451).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: ibmveth: added KUnit tests for some buffer pool functions (jsc#PED-16852).\n- net: ibmveth: Indented struct ibmveth_adapter correctly (jsc#PED-16852).\n- net: ibmveth: Refactored veth_pool_store for better maintainability (jsc#PED-16852).\n- net: ibmveth: Reset the adapter when unexpected states are detected (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/perf: Set cpumode flags using sample address (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: davinci: Unset POWERDOWN bit when releasing resources (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- USB: make to_usb_driver() use container_of_const() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mce: Add support for physical address valid bit (jsc#PED-16968).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951).\n- xfs: don't free cowblocks from under dirty pagecache on unshare (bsc#1278709).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-13T11:52:05Z","modified":"2026-10-14T11:15:08.088253504Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4660-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- Also reflect disabled BATMAN in supported.conf.\n- Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- Disable CONFIG_CAN (jsc#PED-16993).\n- Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401).\n- kernel-binary.spec.in: Fix syntax error.\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- perf: Reject exited events as group leaders (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n","status":"published","published":"2026-10-14T10:08:58Z","modified":"2026-10-14T17:30:08.621268283Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4665-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).\n- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n- Disable BATMAN in supported.conf.\n- Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- Disable CONFIG_CAN (jsc#PED-16993). \n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 \n  jsc#PED-1225).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (bsc#1277254).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (bsc#1281085).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: fix data/file corruption on reconnects (bsc#1253005).\n- smb: client: fix stuck kworkers on reconnects during writes (bsc#1253005).\n","status":"published","published":"2026-10-14T12:53:55Z","modified":"2026-10-15T10:30:35.424255939Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4666-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).\n- CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).\n- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- Also reflect disabled BATMAN in supported.conf. \n- Disable CONFIG_CAN (jsc#PED-16993).\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223\n  jsc#PED-1225).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n","status":"published","published":"2026-10-14T12:54:21Z","modified":"2026-10-16T17:23:12.747828757Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4667-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).\n- CVE-2025-39964: kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2025-40022: kernel: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223\n  jsc#PED-1225).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (bsc#1277254).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (bsc#1281085).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: fix data/file corruption on reconnects (bsc#1253005).\n- smb: client: fix stuck kworkers on reconnects during writes (bsc#1253005).\n","status":"published","published":"2026-10-14T12:57:48Z","modified":"2026-10-16T17:23:12.752303658Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4668-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).\n- CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).\n- CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).\n- CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223\n  jsc#PED-1225).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n","status":"published","published":"2026-10-14T13:01:10Z","modified":"2026-10-15T10:30:35.973189035Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4687-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).\n- CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).\n- CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).\n- CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).\n- CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).\n- CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).\n- CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).\n- CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).\n- CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).\n- CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).\n- CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).\n- CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).\n- CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64496: iio: event: Fix event FIFO reset race (bsc#1273600).\n- CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (bsc#1273302).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-68108: drm/amdgpu/vce: fix integer overflow in image size (bsc#1274869).\n- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).\n- CVE-2026-68184: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (bsc#1274981).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68350: wifi: carl9170: fix OOB read from off-by-two in TX status handler (bsc#1274682).\n- CVE-2026-68365: USB: serial: io_edgeport: cap received transmit credits (bsc#1276257).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-68479: Bluetooth: btrtl: validate firmware patch bounds (bsc#1276585).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72166: net/9p: avoid -ERESTARTSYS leak to userspace (bsc#1277556).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: fix false-positive __read_overflow2_field() warning (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74276: spi: xilinx: use FIFO occupancy register to determine buffer size (bsc#1276495).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74386: nvmet-tcp: fix a memory leak when releasing a queue (bsc#1277098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74424: fbcon: fix NULL pointer dereference for a console without vc_data (bsc#1276321).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode (bsc#1275957).\n- CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (bsc#1275958).\n- CVE-2026-74499: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (bsc#1275959).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (bsc#1277881).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs (bsc#1276934).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74691: net: thunderbolt: Tear down DMA paths before stopping the rings (bsc#1276925).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header (bsc#1279809).\n- CVE-2026-80800: nfc: llcp: bound the connect_sn TLV walk to the skb (bsc#1279812).\n- CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (bsc#1279485).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80908: drm/amdgpu: Reject UVD message with dimensions above 4096 (bsc#1279627).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-81005: ipmi: si: Fix NULL pointer dereference after failed registration (bsc#1280230).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: Do not reset transport on data digest errors (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (bsc#1280581).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89752: mm: memcg: stop reclaim when a limit update is superseded (bsc#1281176).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice (bsc#1281352).\n- CVE-2026-89927: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (bsc#1281429).\n- CVE-2026-89929: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90223: nfc: llcp: bound SNL TLV parsing to the skb and add length checks (bsc#1281708).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (git-fixes).\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- Fix backport of 'RDMA/efa: Fix PBL chunk length computation' Refresh:.\n- gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- RDMA/efa: Fix PBL chunk length computation.\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- scripts/osc_wrapper: Select repository appropriate for architecture.\n- scripts: Add kernel_repos.\n- scripts: obsapi: Kick get_kernel_projects from uploader \n- scripts: obsapi: Kick get_project_repo_archs from uploader \n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb3: missing inode locks in punch hole (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- xfs: don't drain buffer lru on freeze and read-only remount (bsc#1280223).\n","status":"published","published":"2026-10-15T12:38:33Z","modified":"2026-10-16T10:30:20.089916452Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4706-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).\n- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer (bsc#1254408).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).\n- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).\n- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (bsc#1273512).\n- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).\n- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72125: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER (bsc#1277535).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).\n- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).\n- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74533: replace additional lock in hci_conn with a common spinlock (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).\n- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).\n- CVE-2026-74551: hwmon: (nzxt-smart2) DMA-align output buffer (bsc#1275680).\n- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80947: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (bsc#1280239).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).\n- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).\n- CVE-2026-89636: smb: client: clear ce-\u003etgthint in free_tgts() (bsc#1281042).\n- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).\n- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).\n- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90047: drm/xe: Don't hand out the flat CCS storage as usable VRAM (bsc#1280927).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).\n- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).\n- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).\n- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).\n- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).\n- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).\n- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).\n- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).\n- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).\n- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).\n- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Fix potential NULL pointer dereference (bsc#1283130).\n- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing -\u003eci_dentry (bsc#1283121).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices (git-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: Propagate write errors in generic mixer put callbacks (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ('Disable CONFIG_BATMAN_ADV (jsc#PED-16892)').\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).\n- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).\n- ASoC: ux500: Propagate MSP setup errors (git-fixes).\n- ASoC: ux500: Request the MSP MMIO resource (git-fixes).\n- ASoC: ux500: Validate MSP DAI configuration (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Export few static functions (stable-fixes).\n- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).\n- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- char/nvram: Remove redundant nvram_mutex (stable-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Better advertise dev_err_probe() (stable-fixes).\n- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).\n- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/ast: Automatically clean up poll helper (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- drm: rz-du: Ensure correct suspend/resume ordering with VSP (stable-fixes).\n- EDAC/amd64: Add support for AMD family 1Ah-based newer models (jsc#PED-16968).\n- EDAC/mc_sysfs: Increase legacy channel support to 16 (jsc#PED-16968).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).\n- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).\n- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).\n- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).\n- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).\n- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).\n- hwmon: (emc1403) Convert to with_info API (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: core: fix adapter registration race (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).\n- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions \u003c 1.1 (git-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (jsc#PED-16854).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- inode: make __iget() a static inline (bsc#1282383).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).\n- iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX (git-fixes).\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: s390: pci: Fix aisb calculation (bsc#1277451).\n- KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (bsc#1277451).\n- KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (bsc#1277451).\n- KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1277451).\n- KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (bsc#1277451).\n- KVM: s390: pci: Fix missing error codes and memory unaccounting (bsc#1277451).\n- KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277451).\n- KVM: s390: pci: Fix resource leak on IRQ registration failure (bsc#1277451).\n- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1277451).\n- KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (bsc#1277451).\n- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL\u003e0 #GP on Intel (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).\n- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).\n- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).\n- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: ibmveth: added KUnit tests for some buffer pool functions (jsc#PED-16852).\n- net: ibmveth: Indented struct ibmveth_adapter correctly (jsc#PED-16852).\n- net: ibmveth: Refactored veth_pool_store for better maintainability (jsc#PED-16852).\n- net: ibmveth: Reset the adapter when unexpected states are detected (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/perf: Set cpumode flags using sample address (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).\n- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb: client: harden DFS cache against invalid target hints (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).\n- spi: core: Abort active target transfer on controller suspend (stable-fixes).\n- spi: davinci: Unset POWERDOWN bit when releasing resources (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).\n- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).\n- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).\n- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- USB: make to_usb_driver() use container_of_const() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).\n- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- x86/mce: Add support for physical address valid bit (jsc#PED-16968).\n- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951).\n- xfs: don't free cowblocks from under dirty pagecache on unshare (bsc#1278709).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-16T13:33:59Z","modified":"2026-10-17T10:00:05.985817162Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8875-1","title":"linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities","description":"It was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Reset controller framework;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - USB DSL drivers;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - KVM subsystem;\n  - Networking core;\n  - Netfilter;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Memory Management;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - IPv4 networking;\n  - SCTP protocol;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - ESS Solo-1 ALSA driver;\n  - HD-audio driver;\n  - Simple audio multiplexer codec driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131,\nCVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219,\nCVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999,\nCVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038,\nCVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069,\nCVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091,\nCVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159,\nCVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320,\nCVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910,\nCVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923,\nCVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930,\nCVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939,\nCVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53133,\nCVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137,\nCVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148,\nCVE-2026-53149, CVE-2026-53150, CVE-2026-53157, CVE-2026-53158,\nCVE-2026-53159, CVE-2026-53161, CVE-2026-53163, CVE-2026-53167,\nCVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53189,\nCVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199,\nCVE-2026-53208, CVE-2026-53213, CVE-2026-53217, CVE-2026-53218,\nCVE-2026-53219, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238,\nCVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252,\nCVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,\nCVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266,\nCVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,\nCVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331,\nCVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352,\nCVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53381,\nCVE-2026-53382, CVE-2026-53383, CVE-2026-53385, CVE-2026-53388,\nCVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397,\nCVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403,\nCVE-2026-63794, CVE-2026-63796, CVE-2026-63798, CVE-2026-63801,\nCVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63809,\nCVE-2026-63810, CVE-2026-63814, CVE-2026-63815, CVE-2026-63817,\nCVE-2026-63818, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824,\nCVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830,\nCVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835,\nCVE-2026-63836, CVE-2026-63867, CVE-2026-63868, CVE-2026-63870,\nCVE-2026-63875, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891,\nCVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63897,\nCVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901,\nCVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,\nCVE-2026-63908, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915,\nCVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920,\nCVE-2026-63921, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927,\nCVE-2026-63928, CVE-2026-63930, CVE-2026-63931, CVE-2026-63933,\nCVE-2026-63934, CVE-2026-63942, CVE-2026-63947, CVE-2026-63948,\nCVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63960,\nCVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63971,\nCVE-2026-63975, CVE-2026-63976, CVE-2026-63985, CVE-2026-63990,\nCVE-2026-63991, CVE-2026-64002, CVE-2026-64004, CVE-2026-64005,\nCVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012,\nCVE-2026-64014, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206,\nCVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237,\nCVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249,\nCVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271,\nCVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298,\nCVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304,\nCVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,\nCVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322,\nCVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330,\nCVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,\nCVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,\nCVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,\nCVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,\nCVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360,\nCVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364,\nCVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,\nCVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380,\nCVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403,\nCVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,\nCVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425,\nCVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432,\nCVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,\nCVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,\nCVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450,\nCVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,\nCVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468,\nCVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475,\nCVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,\nCVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,\nCVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504,\nCVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,\nCVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529,\nCVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534,\nCVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538,\nCVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,\nCVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548,\nCVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553,\nCVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,\nCVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569,\nCVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576,\nCVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,\nCVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599,\nCVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088,\nCVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,\nCVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182,\nCVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187,\nCVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,\nCVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204,\nCVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214,\nCVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,\nCVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227,\nCVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243,\nCVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,\nCVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376,\nCVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397,\nCVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,\nCVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413,\nCVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425,\nCVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,\nCVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450,\nCVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459,\nCVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,\nCVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022,\nCVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036,\nCVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048,\nCVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055,\nCVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067,\nCVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078,\nCVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083,\nCVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72088,\nCVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,\nCVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115,\nCVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119,\nCVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123,\nCVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129,\nCVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138,\nCVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159,\nCVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165,\nCVE-2026-72166, CVE-2026-72167, CVE-2026-72171, CVE-2026-72181,\nCVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194,\nCVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218,\nCVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225,\nCVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230,\nCVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234,\nCVE-2026-72235, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241,\nCVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251,\nCVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267,\nCVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271,\nCVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276,\nCVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297,\nCVE-2026-72298, CVE-2026-72306, CVE-2026-72307, CVE-2026-72310,\nCVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322,\nCVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348,\nCVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371,\nCVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392,\nCVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409,\nCVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422,\nCVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441,\nCVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459,\nCVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479,\nCVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489,\nCVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255,\nCVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267,\nCVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281,\nCVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287,\nCVE-2026-74288, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295,\nCVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313,\nCVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329,\nCVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340,\nCVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351,\nCVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379,\nCVE-2026-74382, CVE-2026-74384, CVE-2026-74390, CVE-2026-74394,\nCVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402,\nCVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424,\nCVE-2026-74426, CVE-2026-74427, CVE-2026-74438, CVE-2026-74443,\nCVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456,\nCVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460,\nCVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465,\nCVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471,\nCVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480,\nCVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488,\nCVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495,\nCVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505,\nCVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518,\nCVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577,\nCVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581,\nCVE-2026-74583, CVE-2026-74584, CVE-2026-74585, CVE-2026-74586,\nCVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597,\nCVE-2026-74598, CVE-2026-74604, CVE-2026-74609, CVE-2026-74613,\nCVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620,\nCVE-2026-74622, CVE-2026-74625, CVE-2026-74630, CVE-2026-74635,\nCVE-2026-74636, CVE-2026-74641, CVE-2026-74648, CVE-2026-74649,\nCVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656,\nCVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660,\nCVE-2026-74664, CVE-2026-74667, CVE-2026-74669, CVE-2026-74671,\nCVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74679,\nCVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688,\nCVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694,\nCVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704,\nCVE-2026-74705, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720,\nCVE-2026-74726, CVE-2026-74730, CVE-2026-80591, CVE-2026-80593,\nCVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598,\nCVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603,\nCVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619,\nCVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630,\nCVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647,\nCVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664,\nCVE-2026-80677, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681,\nCVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80714,\nCVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722,\nCVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80867,\nCVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879,\nCVE-2026-80880, CVE-2026-80881, CVE-2026-80886, CVE-2026-80890,\nCVE-2026-80902, CVE-2026-89774)\n","status":"published","published":"2026-10-06T10:11:54Z","modified":"2026-11-09T12:57:13.092440605Z","updated_at":"2026-11-07T02:28:12.524765Z"},{"id":"USN-8875-2","title":"linux-nvidia vulnerabilities","description":"It was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Reset controller framework;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - USB DSL drivers;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - KVM subsystem;\n  - Networking core;\n  - Netfilter;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Memory Management;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - IPv4 networking;\n  - SCTP protocol;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - ESS Solo-1 ALSA driver;\n  - HD-audio driver;\n  - Simple audio multiplexer codec driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131,\nCVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219,\nCVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999,\nCVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038,\nCVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069,\nCVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091,\nCVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159,\nCVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320,\nCVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910,\nCVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923,\nCVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930,\nCVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939,\nCVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53133,\nCVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137,\nCVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148,\nCVE-2026-53149, CVE-2026-53150, CVE-2026-53157, CVE-2026-53158,\nCVE-2026-53159, CVE-2026-53161, CVE-2026-53163, CVE-2026-53167,\nCVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53189,\nCVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199,\nCVE-2026-53208, CVE-2026-53213, CVE-2026-53217, CVE-2026-53218,\nCVE-2026-53219, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238,\nCVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252,\nCVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,\nCVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266,\nCVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,\nCVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331,\nCVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352,\nCVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53381,\nCVE-2026-53382, CVE-2026-53383, CVE-2026-53385, CVE-2026-53388,\nCVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397,\nCVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403,\nCVE-2026-63794, CVE-2026-63796, CVE-2026-63798, CVE-2026-63801,\nCVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63809,\nCVE-2026-63810, CVE-2026-63814, CVE-2026-63815, CVE-2026-63817,\nCVE-2026-63818, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824,\nCVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830,\nCVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835,\nCVE-2026-63836, CVE-2026-63867, CVE-2026-63868, CVE-2026-63870,\nCVE-2026-63875, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891,\nCVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63897,\nCVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901,\nCVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,\nCVE-2026-63908, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915,\nCVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920,\nCVE-2026-63921, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927,\nCVE-2026-63928, CVE-2026-63930, CVE-2026-63931, CVE-2026-63933,\nCVE-2026-63934, CVE-2026-63942, CVE-2026-63947, CVE-2026-63948,\nCVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63960,\nCVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63971,\nCVE-2026-63975, CVE-2026-63976, CVE-2026-63985, CVE-2026-63990,\nCVE-2026-63991, CVE-2026-64002, CVE-2026-64004, CVE-2026-64005,\nCVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012,\nCVE-2026-64014, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206,\nCVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237,\nCVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249,\nCVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271,\nCVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298,\nCVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304,\nCVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,\nCVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322,\nCVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330,\nCVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,\nCVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,\nCVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,\nCVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,\nCVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360,\nCVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364,\nCVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,\nCVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380,\nCVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403,\nCVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,\nCVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425,\nCVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432,\nCVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,\nCVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,\nCVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450,\nCVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,\nCVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468,\nCVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475,\nCVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,\nCVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,\nCVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504,\nCVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,\nCVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529,\nCVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534,\nCVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538,\nCVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,\nCVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548,\nCVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553,\nCVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,\nCVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569,\nCVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576,\nCVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,\nCVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599,\nCVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088,\nCVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,\nCVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182,\nCVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187,\nCVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,\nCVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204,\nCVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214,\nCVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,\nCVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227,\nCVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243,\nCVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,\nCVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376,\nCVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397,\nCVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,\nCVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413,\nCVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425,\nCVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,\nCVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450,\nCVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459,\nCVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,\nCVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022,\nCVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036,\nCVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048,\nCVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055,\nCVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067,\nCVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078,\nCVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083,\nCVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72088,\nCVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,\nCVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115,\nCVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119,\nCVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123,\nCVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129,\nCVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138,\nCVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159,\nCVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165,\nCVE-2026-72166, CVE-2026-72167, CVE-2026-72171, CVE-2026-72181,\nCVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194,\nCVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218,\nCVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225,\nCVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230,\nCVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234,\nCVE-2026-72235, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241,\nCVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251,\nCVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267,\nCVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271,\nCVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276,\nCVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297,\nCVE-2026-72298, CVE-2026-72306, CVE-2026-72307, CVE-2026-72310,\nCVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322,\nCVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348,\nCVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371,\nCVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392,\nCVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409,\nCVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422,\nCVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441,\nCVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459,\nCVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479,\nCVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489,\nCVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255,\nCVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267,\nCVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281,\nCVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287,\nCVE-2026-74288, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295,\nCVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313,\nCVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329,\nCVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340,\nCVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351,\nCVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379,\nCVE-2026-74382, CVE-2026-74384, CVE-2026-74390, CVE-2026-74394,\nCVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402,\nCVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424,\nCVE-2026-74426, CVE-2026-74427, CVE-2026-74438, CVE-2026-74443,\nCVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456,\nCVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460,\nCVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465,\nCVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471,\nCVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480,\nCVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488,\nCVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495,\nCVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505,\nCVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518,\nCVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577,\nCVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581,\nCVE-2026-74583, CVE-2026-74584, CVE-2026-74585, CVE-2026-74586,\nCVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597,\nCVE-2026-74598, CVE-2026-74604, CVE-2026-74609, CVE-2026-74613,\nCVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620,\nCVE-2026-74622, CVE-2026-74625, CVE-2026-74630, CVE-2026-74635,\nCVE-2026-74636, CVE-2026-74641, CVE-2026-74648, CVE-2026-74649,\nCVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656,\nCVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660,\nCVE-2026-74664, CVE-2026-74667, CVE-2026-74669, CVE-2026-74671,\nCVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74679,\nCVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688,\nCVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694,\nCVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704,\nCVE-2026-74705, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720,\nCVE-2026-74726, CVE-2026-74730, CVE-2026-80591, CVE-2026-80593,\nCVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598,\nCVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603,\nCVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619,\nCVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630,\nCVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647,\nCVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664,\nCVE-2026-80677, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681,\nCVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80714,\nCVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722,\nCVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80867,\nCVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879,\nCVE-2026-80880, CVE-2026-80881, CVE-2026-80886, CVE-2026-80890,\nCVE-2026-80902, CVE-2026-89774)\n","status":"published","published":"2026-10-09T08:38:43Z","modified":"2026-11-09T12:48:15.608953479Z","updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"USN-8877-1","title":"linux-gcp, linux-gcp-fips vulnerabilities","description":"It was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Reset controller framework;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - USB DSL drivers;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - KVM subsystem;\n  - Networking core;\n  - Netfilter;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Memory Management;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - IPv4 networking;\n  - SCTP protocol;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - ESS Solo-1 ALSA driver;\n  - HD-audio driver;\n  - Simple audio multiplexer codec driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131,\nCVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219,\nCVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999,\nCVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038,\nCVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069,\nCVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091,\nCVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159,\nCVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320,\nCVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910,\nCVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923,\nCVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930,\nCVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939,\nCVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53133,\nCVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137,\nCVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148,\nCVE-2026-53149, CVE-2026-53150, CVE-2026-53157, CVE-2026-53158,\nCVE-2026-53159, CVE-2026-53161, CVE-2026-53163, CVE-2026-53167,\nCVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53189,\nCVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199,\nCVE-2026-53208, CVE-2026-53213, CVE-2026-53217, CVE-2026-53218,\nCVE-2026-53219, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238,\nCVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252,\nCVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,\nCVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266,\nCVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,\nCVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331,\nCVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352,\nCVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53381,\nCVE-2026-53382, CVE-2026-53383, CVE-2026-53385, CVE-2026-53388,\nCVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397,\nCVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403,\nCVE-2026-63794, CVE-2026-63796, CVE-2026-63798, CVE-2026-63801,\nCVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63809,\nCVE-2026-63810, CVE-2026-63814, CVE-2026-63815, CVE-2026-63817,\nCVE-2026-63818, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824,\nCVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830,\nCVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835,\nCVE-2026-63836, CVE-2026-63867, CVE-2026-63868, CVE-2026-63870,\nCVE-2026-63875, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891,\nCVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63897,\nCVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901,\nCVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,\nCVE-2026-63908, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915,\nCVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920,\nCVE-2026-63921, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927,\nCVE-2026-63928, CVE-2026-63930, CVE-2026-63931, CVE-2026-63933,\nCVE-2026-63934, CVE-2026-63942, CVE-2026-63947, CVE-2026-63948,\nCVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63960,\nCVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63971,\nCVE-2026-63975, CVE-2026-63976, CVE-2026-63985, CVE-2026-63990,\nCVE-2026-63991, CVE-2026-64002, CVE-2026-64004, CVE-2026-64005,\nCVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012,\nCVE-2026-64014, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206,\nCVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237,\nCVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249,\nCVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271,\nCVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298,\nCVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304,\nCVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,\nCVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322,\nCVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330,\nCVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,\nCVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,\nCVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,\nCVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,\nCVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360,\nCVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364,\nCVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,\nCVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380,\nCVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403,\nCVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,\nCVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425,\nCVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432,\nCVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,\nCVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,\nCVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450,\nCVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,\nCVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468,\nCVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475,\nCVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,\nCVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,\nCVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504,\nCVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,\nCVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529,\nCVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534,\nCVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538,\nCVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,\nCVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548,\nCVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553,\nCVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,\nCVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569,\nCVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576,\nCVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,\nCVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599,\nCVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088,\nCVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,\nCVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182,\nCVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187,\nCVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,\nCVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204,\nCVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214,\nCVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,\nCVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227,\nCVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243,\nCVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,\nCVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376,\nCVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397,\nCVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,\nCVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413,\nCVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425,\nCVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,\nCVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450,\nCVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459,\nCVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,\nCVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022,\nCVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036,\nCVE-2026-72038, CVE-2026-72039, CVE-2026-72046, CVE-2026-72047,\nCVE-2026-72048, CVE-2026-72049, CVE-2026-72052, CVE-2026-72054,\nCVE-2026-72055, CVE-2026-72056, CVE-2026-72061, CVE-2026-72066,\nCVE-2026-72067, CVE-2026-72068, CVE-2026-72074, CVE-2026-72076,\nCVE-2026-72078, CVE-2026-72079, CVE-2026-72081, CVE-2026-72082,\nCVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72086,\nCVE-2026-72088, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107,\nCVE-2026-72108, CVE-2026-72109, CVE-2026-72113, CVE-2026-72114,\nCVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118,\nCVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122,\nCVE-2026-72123, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126,\nCVE-2026-72129, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136,\nCVE-2026-72138, CVE-2026-72140, CVE-2026-72146, CVE-2026-72153,\nCVE-2026-72159, CVE-2026-72160, CVE-2026-72163, CVE-2026-72164,\nCVE-2026-72165, CVE-2026-72166, CVE-2026-72167, CVE-2026-72171,\nCVE-2026-72181, CVE-2026-72182, CVE-2026-72192, CVE-2026-72193,\nCVE-2026-72194, CVE-2026-72195, CVE-2026-72197, CVE-2026-72215,\nCVE-2026-72218, CVE-2026-72219, CVE-2026-72223, CVE-2026-72224,\nCVE-2026-72225, CVE-2026-72226, CVE-2026-72228, CVE-2026-72229,\nCVE-2026-72230, CVE-2026-72231, CVE-2026-72232, CVE-2026-72233,\nCVE-2026-72234, CVE-2026-72235, CVE-2026-72238, CVE-2026-72240,\nCVE-2026-72241, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250,\nCVE-2026-72251, CVE-2026-72256, CVE-2026-72264, CVE-2026-72265,\nCVE-2026-72267, CVE-2026-72268, CVE-2026-72269, CVE-2026-72270,\nCVE-2026-72271, CVE-2026-72272, CVE-2026-72274, CVE-2026-72275,\nCVE-2026-72276, CVE-2026-72282, CVE-2026-72289, CVE-2026-72296,\nCVE-2026-72297, CVE-2026-72298, CVE-2026-72306, CVE-2026-72307,\nCVE-2026-72310, CVE-2026-72314, CVE-2026-72316, CVE-2026-72319,\nCVE-2026-72322, CVE-2026-72326, CVE-2026-72339, CVE-2026-72347,\nCVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351,\nCVE-2026-72371, CVE-2026-72374, CVE-2026-72378, CVE-2026-72389,\nCVE-2026-72392, CVE-2026-72396, CVE-2026-72400, CVE-2026-72406,\nCVE-2026-72409, CVE-2026-72414, CVE-2026-72418, CVE-2026-72421,\nCVE-2026-72422, CVE-2026-72428, CVE-2026-72433, CVE-2026-72435,\nCVE-2026-72441, CVE-2026-72447, CVE-2026-72448, CVE-2026-72450,\nCVE-2026-72459, CVE-2026-72460, CVE-2026-72466, CVE-2026-72476,\nCVE-2026-72479, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484,\nCVE-2026-72489, CVE-2026-72491, CVE-2026-72492, CVE-2026-72502,\nCVE-2026-74255, CVE-2026-74256, CVE-2026-74262, CVE-2026-74265,\nCVE-2026-74267, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280,\nCVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284,\nCVE-2026-74287, CVE-2026-74288, CVE-2026-74292, CVE-2026-74293,\nCVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312,\nCVE-2026-74313, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327,\nCVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339,\nCVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349,\nCVE-2026-74351, CVE-2026-74359, CVE-2026-74363, CVE-2026-74376,\nCVE-2026-74379, CVE-2026-74382, CVE-2026-74384, CVE-2026-74390,\nCVE-2026-74394, CVE-2026-74395, CVE-2026-74398, CVE-2026-74399,\nCVE-2026-74402, CVE-2026-74408, CVE-2026-74410, CVE-2026-74416,\nCVE-2026-74424, CVE-2026-74426, CVE-2026-74427, CVE-2026-74438,\nCVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74455,\nCVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74459,\nCVE-2026-74460, CVE-2026-74461, CVE-2026-74463, CVE-2026-74464,\nCVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469,\nCVE-2026-74471, CVE-2026-74473, CVE-2026-74475, CVE-2026-74478,\nCVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485,\nCVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493,\nCVE-2026-74495, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499,\nCVE-2026-74505, CVE-2026-74507, CVE-2026-74508, CVE-2026-74512,\nCVE-2026-74518, CVE-2026-74519, CVE-2026-74523, CVE-2026-74525,\nCVE-2026-74540, CVE-2026-74546, CVE-2026-74547, CVE-2026-74548,\nCVE-2026-74549, CVE-2026-74556, CVE-2026-74557, CVE-2026-74563,\nCVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569,\nCVE-2026-74577, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580,\nCVE-2026-74581, CVE-2026-74583, CVE-2026-74584, CVE-2026-74585,\nCVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589,\nCVE-2026-74597, CVE-2026-74598, CVE-2026-74604, CVE-2026-74609,\nCVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616,\nCVE-2026-74620, CVE-2026-74622, CVE-2026-74625, CVE-2026-74630,\nCVE-2026-74635, CVE-2026-74636, CVE-2026-74641, CVE-2026-74648,\nCVE-2026-74649, CVE-2026-74650, CVE-2026-74651, CVE-2026-74654,\nCVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659,\nCVE-2026-74660, CVE-2026-74664, CVE-2026-74667, CVE-2026-74669,\nCVE-2026-74671, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676,\nCVE-2026-74679, CVE-2026-74680, CVE-2026-74682, CVE-2026-74683,\nCVE-2026-74688, CVE-2026-74691, CVE-2026-74692, CVE-2026-74693,\nCVE-2026-74694, CVE-2026-74696, CVE-2026-74697, CVE-2026-74701,\nCVE-2026-74704, CVE-2026-74705, CVE-2026-74717, CVE-2026-74719,\nCVE-2026-74720, CVE-2026-74726, CVE-2026-74730, CVE-2026-80591,\nCVE-2026-80593, CVE-2026-80594, CVE-2026-80595, CVE-2026-80597,\nCVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601,\nCVE-2026-80603, CVE-2026-80605, CVE-2026-80609, CVE-2026-80613,\nCVE-2026-80619, CVE-2026-80622, CVE-2026-80626, CVE-2026-80627,\nCVE-2026-80630, CVE-2026-80644, CVE-2026-80645, CVE-2026-80646,\nCVE-2026-80647, CVE-2026-80649, CVE-2026-80652, CVE-2026-80659,\nCVE-2026-80664, CVE-2026-80677, CVE-2026-80679, CVE-2026-80680,\nCVE-2026-80681, CVE-2026-80706, CVE-2026-80707, CVE-2026-80708,\nCVE-2026-80714, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718,\nCVE-2026-80722, CVE-2026-80731, CVE-2026-80732, CVE-2026-80733,\nCVE-2026-80867, CVE-2026-80875, CVE-2026-80876, CVE-2026-80877,\nCVE-2026-80879, CVE-2026-80880, CVE-2026-80881, CVE-2026-80886,\nCVE-2026-80890, CVE-2026-80902, CVE-2026-89774)\n","status":"published","published":"2026-10-06T10:10:41Z","modified":"2026-11-09T12:49:18.170833445Z","updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"USN-8878-1","title":"linux-gcp-5.15 vulnerabilities","description":"It was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nIt was discovered that some Arm processors could complete a broadcast\ntranslation lookaside buffer (TLB) invalidation before memory writes made\nthrough the invalidated translation were globally observed. A local\nattacker could possibly use this to write to memory after permission to do\nso had been revoked, bypassing memory protections or escalating privileges.\n(CVE-2025-10263)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Reset controller framework;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - USB DSL drivers;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - KVM subsystem;\n  - Networking core;\n  - Netfilter;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Memory Management;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - IPv4 networking;\n  - SCTP protocol;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - ESS Solo-1 ALSA driver;\n  - HD-audio driver;\n  - Simple audio multiplexer codec driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131,\nCVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219,\nCVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999,\nCVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038,\nCVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069,\nCVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091,\nCVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159,\nCVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320,\nCVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910,\nCVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923,\nCVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930,\nCVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939,\nCVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53131,\nCVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136,\nCVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53146,\nCVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53157,\nCVE-2026-53158, CVE-2026-53159, CVE-2026-53161, CVE-2026-53163,\nCVE-2026-53167, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181,\nCVE-2026-53186, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195,\nCVE-2026-53196, CVE-2026-53199, CVE-2026-53208, CVE-2026-53213,\nCVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219,\nCVE-2026-53221, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238,\nCVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252,\nCVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,\nCVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266,\nCVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,\nCVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331,\nCVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352,\nCVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53357,\nCVE-2026-53358, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383,\nCVE-2026-53385, CVE-2026-53388, CVE-2026-53391, CVE-2026-53392,\nCVE-2026-53393, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399,\nCVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794,\nCVE-2026-63796, CVE-2026-63798, CVE-2026-63800, CVE-2026-63801,\nCVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808,\nCVE-2026-63809, CVE-2026-63810, CVE-2026-63814, CVE-2026-63815,\nCVE-2026-63817, CVE-2026-63818, CVE-2026-63822, CVE-2026-63823,\nCVE-2026-63824, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829,\nCVE-2026-63830, CVE-2026-63831, CVE-2026-63833, CVE-2026-63834,\nCVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868,\nCVE-2026-63870, CVE-2026-63875, CVE-2026-63887, CVE-2026-63888,\nCVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892,\nCVE-2026-63893, CVE-2026-63895, CVE-2026-63897, CVE-2026-63898,\nCVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902,\nCVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908,\nCVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915,\nCVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920,\nCVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925,\nCVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63930,\nCVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63942,\nCVE-2026-63947, CVE-2026-63948, CVE-2026-63954, CVE-2026-63956,\nCVE-2026-63957, CVE-2026-63960, CVE-2026-63961, CVE-2026-63964,\nCVE-2026-63967, CVE-2026-63971, CVE-2026-63975, CVE-2026-63976,\nCVE-2026-63984, CVE-2026-63985, CVE-2026-63990, CVE-2026-63991,\nCVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64002,\nCVE-2026-64004, CVE-2026-64005, CVE-2026-64007, CVE-2026-64009,\nCVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64014,\nCVE-2026-64090, CVE-2026-64091, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206,\nCVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237,\nCVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249,\nCVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271,\nCVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298,\nCVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304,\nCVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,\nCVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322,\nCVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330,\nCVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,\nCVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,\nCVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,\nCVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,\nCVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360,\nCVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364,\nCVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,\nCVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380,\nCVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403,\nCVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,\nCVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425,\nCVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432,\nCVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,\nCVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,\nCVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450,\nCVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,\nCVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468,\nCVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475,\nCVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,\nCVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,\nCVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504,\nCVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,\nCVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529,\nCVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534,\nCVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538,\nCVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,\nCVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548,\nCVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553,\nCVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,\nCVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569,\nCVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576,\nCVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,\nCVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599,\nCVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088,\nCVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,\nCVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182,\nCVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187,\nCVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,\nCVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204,\nCVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214,\nCVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,\nCVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227,\nCVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243,\nCVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,\nCVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376,\nCVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397,\nCVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,\nCVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413,\nCVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425,\nCVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,\nCVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450,\nCVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459,\nCVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,\nCVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022,\nCVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036,\nCVE-2026-72038, CVE-2026-72039, CVE-2026-72046, CVE-2026-72047,\nCVE-2026-72048, CVE-2026-72049, CVE-2026-72052, CVE-2026-72054,\nCVE-2026-72055, CVE-2026-72056, CVE-2026-72061, CVE-2026-72066,\nCVE-2026-72067, CVE-2026-72068, CVE-2026-72074, CVE-2026-72076,\nCVE-2026-72078, CVE-2026-72079, CVE-2026-72081, CVE-2026-72082,\nCVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72086,\nCVE-2026-72088, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107,\nCVE-2026-72108, CVE-2026-72109, CVE-2026-72113, CVE-2026-72114,\nCVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118,\nCVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122,\nCVE-2026-72123, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126,\nCVE-2026-72129, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136,\nCVE-2026-72138, CVE-2026-72140, CVE-2026-72146, CVE-2026-72153,\nCVE-2026-72159, CVE-2026-72160, CVE-2026-72163, CVE-2026-72164,\nCVE-2026-72165, CVE-2026-72166, CVE-2026-72167, CVE-2026-72171,\nCVE-2026-72181, CVE-2026-72182, CVE-2026-72192, CVE-2026-72193,\nCVE-2026-72194, CVE-2026-72195, CVE-2026-72197, CVE-2026-72215,\nCVE-2026-72218, CVE-2026-72219, CVE-2026-72223, CVE-2026-72224,\nCVE-2026-72225, CVE-2026-72226, CVE-2026-72228, CVE-2026-72229,\nCVE-2026-72230, CVE-2026-72231, CVE-2026-72232, CVE-2026-72233,\nCVE-2026-72234, CVE-2026-72235, CVE-2026-72238, CVE-2026-72240,\nCVE-2026-72241, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250,\nCVE-2026-72251, CVE-2026-72256, CVE-2026-72264, CVE-2026-72265,\nCVE-2026-72267, CVE-2026-72268, CVE-2026-72269, CVE-2026-72270,\nCVE-2026-72271, CVE-2026-72272, CVE-2026-72274, CVE-2026-72275,\nCVE-2026-72276, CVE-2026-72282, CVE-2026-72289, CVE-2026-72296,\nCVE-2026-72297, CVE-2026-72298, CVE-2026-72306, CVE-2026-72307,\nCVE-2026-72310, CVE-2026-72314, CVE-2026-72316, CVE-2026-72319,\nCVE-2026-72322, CVE-2026-72326, CVE-2026-72339, CVE-2026-72347,\nCVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351,\nCVE-2026-72371, CVE-2026-72374, CVE-2026-72378, CVE-2026-72389,\nCVE-2026-72392, CVE-2026-72396, CVE-2026-72400, CVE-2026-72406,\nCVE-2026-72409, CVE-2026-72414, CVE-2026-72418, CVE-2026-72421,\nCVE-2026-72422, CVE-2026-72428, CVE-2026-72433, CVE-2026-72435,\nCVE-2026-72441, CVE-2026-72447, CVE-2026-72448, CVE-2026-72450,\nCVE-2026-72459, CVE-2026-72460, CVE-2026-72466, CVE-2026-72476,\nCVE-2026-72479, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484,\nCVE-2026-72489, CVE-2026-72491, CVE-2026-72492, CVE-2026-72502,\nCVE-2026-74255, CVE-2026-74256, CVE-2026-74262, CVE-2026-74265,\nCVE-2026-74267, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280,\nCVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284,\nCVE-2026-74287, CVE-2026-74288, CVE-2026-74292, CVE-2026-74293,\nCVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312,\nCVE-2026-74313, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327,\nCVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339,\nCVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349,\nCVE-2026-74351, CVE-2026-74359, CVE-2026-74363, CVE-2026-74376,\nCVE-2026-74379, CVE-2026-74382, CVE-2026-74384, CVE-2026-74390,\nCVE-2026-74394, CVE-2026-74395, CVE-2026-74398, CVE-2026-74399,\nCVE-2026-74402, CVE-2026-74408, CVE-2026-74410, CVE-2026-74416,\nCVE-2026-74424, CVE-2026-74426, CVE-2026-74427, CVE-2026-74438,\nCVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74455,\nCVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74459,\nCVE-2026-74460, CVE-2026-74461, CVE-2026-74463, CVE-2026-74464,\nCVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469,\nCVE-2026-74471, CVE-2026-74473, CVE-2026-74475, CVE-2026-74478,\nCVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485,\nCVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493,\nCVE-2026-74495, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499,\nCVE-2026-74505, CVE-2026-74507, CVE-2026-74508, CVE-2026-74512,\nCVE-2026-74518, CVE-2026-74519, CVE-2026-74523, CVE-2026-74525,\nCVE-2026-74540, CVE-2026-74546, CVE-2026-74547, CVE-2026-74548,\nCVE-2026-74549, CVE-2026-74556, CVE-2026-74557, CVE-2026-74563,\nCVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569,\nCVE-2026-74577, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580,\nCVE-2026-74581, CVE-2026-74583, CVE-2026-74584, CVE-2026-74585,\nCVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589,\nCVE-2026-74597, CVE-2026-74598, CVE-2026-74604, CVE-2026-74609,\nCVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616,\nCVE-2026-74620, CVE-2026-74622, CVE-2026-74625, CVE-2026-74630,\nCVE-2026-74635, CVE-2026-74636, CVE-2026-74641, CVE-2026-74648,\nCVE-2026-74649, CVE-2026-74650, CVE-2026-74651, CVE-2026-74654,\nCVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659,\nCVE-2026-74660, CVE-2026-74664, CVE-2026-74667, CVE-2026-74669,\nCVE-2026-74671, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676,\nCVE-2026-74679, CVE-2026-74680, CVE-2026-74682, CVE-2026-74683,\nCVE-2026-74688, CVE-2026-74691, CVE-2026-74692, CVE-2026-74693,\nCVE-2026-74694, CVE-2026-74696, CVE-2026-74697, CVE-2026-74701,\nCVE-2026-74704, CVE-2026-74705, CVE-2026-74717, CVE-2026-74719,\nCVE-2026-74720, CVE-2026-74726, CVE-2026-74730, CVE-2026-80591,\nCVE-2026-80593, CVE-2026-80594, CVE-2026-80595, CVE-2026-80597,\nCVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601,\nCVE-2026-80603, CVE-2026-80605, CVE-2026-80609, CVE-2026-80613,\nCVE-2026-80619, CVE-2026-80622, CVE-2026-80626, CVE-2026-80627,\nCVE-2026-80630, CVE-2026-80644, CVE-2026-80645, CVE-2026-80646,\nCVE-2026-80647, CVE-2026-80649, CVE-2026-80652, CVE-2026-80659,\nCVE-2026-80664, CVE-2026-80677, CVE-2026-80679, CVE-2026-80680,\nCVE-2026-80681, CVE-2026-80706, CVE-2026-80707, CVE-2026-80708,\nCVE-2026-80714, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718,\nCVE-2026-80722, CVE-2026-80731, CVE-2026-80732, CVE-2026-80733,\nCVE-2026-80867, CVE-2026-80875, CVE-2026-80876, CVE-2026-80877,\nCVE-2026-80879, CVE-2026-80880, CVE-2026-80881, CVE-2026-80886,\nCVE-2026-80890, CVE-2026-80902, CVE-2026-89774)\n","status":"published","published":"2026-10-06T10:10:43Z","modified":"2026-11-09T12:48:26.33662059Z","updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"USN-8879-1","title":"linux-oracle-5.15 vulnerabilities","description":"It was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nIt was discovered that some Arm processors could complete a broadcast\ntranslation lookaside buffer (TLB) invalidation before memory writes made\nthrough the invalidated translation were globally observed. A local\nattacker could possibly use this to write to memory after permission to do\nso had been revoked, bypassing memory protections or escalating privileges.\n(CVE-2025-10263)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Reset controller framework;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - USB DSL drivers;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - KVM subsystem;\n  - Networking core;\n  - Netfilter;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Memory Management;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - IPv4 networking;\n  - SCTP protocol;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 9P file system network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - ESS Solo-1 ALSA driver;\n  - HD-audio driver;\n  - Simple audio multiplexer codec driver;\n  - SoC Audio for Freescale CPUs drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131,\nCVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219,\nCVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492,\nCVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999,\nCVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038,\nCVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069,\nCVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091,\nCVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159,\nCVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191,\nCVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252,\nCVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320,\nCVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910,\nCVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923,\nCVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930,\nCVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939,\nCVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53131,\nCVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136,\nCVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53146,\nCVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53157,\nCVE-2026-53158, CVE-2026-53159, CVE-2026-53161, CVE-2026-53163,\nCVE-2026-53167, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181,\nCVE-2026-53186, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195,\nCVE-2026-53196, CVE-2026-53199, CVE-2026-53208, CVE-2026-53213,\nCVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219,\nCVE-2026-53221, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238,\nCVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252,\nCVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,\nCVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266,\nCVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,\nCVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331,\nCVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352,\nCVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53357,\nCVE-2026-53358, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383,\nCVE-2026-53385, CVE-2026-53388, CVE-2026-53391, CVE-2026-53392,\nCVE-2026-53393, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399,\nCVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794,\nCVE-2026-63796, CVE-2026-63798, CVE-2026-63800, CVE-2026-63801,\nCVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808,\nCVE-2026-63809, CVE-2026-63810, CVE-2026-63814, CVE-2026-63815,\nCVE-2026-63817, CVE-2026-63818, CVE-2026-63822, CVE-2026-63823,\nCVE-2026-63824, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829,\nCVE-2026-63830, CVE-2026-63831, CVE-2026-63833, CVE-2026-63834,\nCVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868,\nCVE-2026-63870, CVE-2026-63875, CVE-2026-63887, CVE-2026-63888,\nCVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892,\nCVE-2026-63893, CVE-2026-63895, CVE-2026-63897, CVE-2026-63898,\nCVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902,\nCVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908,\nCVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915,\nCVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920,\nCVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925,\nCVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63930,\nCVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63942,\nCVE-2026-63947, CVE-2026-63948, CVE-2026-63954, CVE-2026-63956,\nCVE-2026-63957, CVE-2026-63960, CVE-2026-63961, CVE-2026-63964,\nCVE-2026-63967, CVE-2026-63971, CVE-2026-63975, CVE-2026-63976,\nCVE-2026-63984, CVE-2026-63985, CVE-2026-63990, CVE-2026-63991,\nCVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64002,\nCVE-2026-64004, CVE-2026-64005, CVE-2026-64007, CVE-2026-64009,\nCVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64014,\nCVE-2026-64090, CVE-2026-64091, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206,\nCVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237,\nCVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249,\nCVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271,\nCVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298,\nCVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304,\nCVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,\nCVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322,\nCVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330,\nCVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,\nCVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,\nCVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,\nCVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,\nCVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360,\nCVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364,\nCVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,\nCVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380,\nCVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403,\nCVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,\nCVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425,\nCVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432,\nCVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,\nCVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,\nCVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450,\nCVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,\nCVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468,\nCVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475,\nCVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,\nCVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,\nCVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504,\nCVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,\nCVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529,\nCVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534,\nCVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538,\nCVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,\nCVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548,\nCVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553,\nCVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,\nCVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569,\nCVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576,\nCVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,\nCVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599,\nCVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088,\nCVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,\nCVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182,\nCVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187,\nCVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,\nCVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204,\nCVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214,\nCVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,\nCVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227,\nCVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243,\nCVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,\nCVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376,\nCVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397,\nCVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,\nCVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413,\nCVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425,\nCVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,\nCVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450,\nCVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459,\nCVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,\nCVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022,\nCVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036,\nCVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048,\nCVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055,\nCVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067,\nCVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078,\nCVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083,\nCVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72088,\nCVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,\nCVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115,\nCVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119,\nCVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123,\nCVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129,\nCVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138,\nCVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159,\nCVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165,\nCVE-2026-72166, CVE-2026-72167, CVE-2026-72171, CVE-2026-72181,\nCVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194,\nCVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218,\nCVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225,\nCVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230,\nCVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234,\nCVE-2026-72235, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241,\nCVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251,\nCVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267,\nCVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271,\nCVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276,\nCVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297,\nCVE-2026-72298, CVE-2026-72306, CVE-2026-72307, CVE-2026-72310,\nCVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322,\nCVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348,\nCVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371,\nCVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392,\nCVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409,\nCVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422,\nCVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441,\nCVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459,\nCVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479,\nCVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489,\nCVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255,\nCVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267,\nCVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281,\nCVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287,\nCVE-2026-74288, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295,\nCVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313,\nCVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329,\nCVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340,\nCVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351,\nCVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379,\nCVE-2026-74382, CVE-2026-74384, CVE-2026-74390, CVE-2026-74394,\nCVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402,\nCVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424,\nCVE-2026-74426, CVE-2026-74427, CVE-2026-74438, CVE-2026-74443,\nCVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456,\nCVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460,\nCVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465,\nCVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471,\nCVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480,\nCVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488,\nCVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495,\nCVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505,\nCVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518,\nCVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577,\nCVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581,\nCVE-2026-74583, CVE-2026-74584, CVE-2026-74585, CVE-2026-74586,\nCVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597,\nCVE-2026-74598, CVE-2026-74604, CVE-2026-74609, CVE-2026-74613,\nCVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620,\nCVE-2026-74622, CVE-2026-74625, CVE-2026-74630, CVE-2026-74635,\nCVE-2026-74636, CVE-2026-74641, CVE-2026-74648, CVE-2026-74649,\nCVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656,\nCVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660,\nCVE-2026-74664, CVE-2026-74667, CVE-2026-74669, CVE-2026-74671,\nCVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74679,\nCVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688,\nCVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694,\nCVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704,\nCVE-2026-74705, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720,\nCVE-2026-74726, CVE-2026-74730, CVE-2026-80591, CVE-2026-80593,\nCVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598,\nCVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603,\nCVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619,\nCVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630,\nCVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647,\nCVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664,\nCVE-2026-80677, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681,\nCVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80714,\nCVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722,\nCVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80867,\nCVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879,\nCVE-2026-80880, CVE-2026-80881, CVE-2026-80886, CVE-2026-80890,\nCVE-2026-80902, CVE-2026-89774)\n","status":"published","published":"2026-10-06T10:10:49Z","modified":"2026-11-09T12:48:52.194440067Z","updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"USN-8886-1","title":"linux-nvidia-tegra vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - Handshake API;\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - OpenRISC architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Intel NPU Driver;\n  - Android drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DMA engine subsystem;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Mouse) drivers;\n  - IOMMU subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - Amazon Nitro Secure Module driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - NTB driver;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - Parport drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - System reset/shutdown drivers;\n  - PTP clock framework;\n  - Voltage and Current Regulator drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Realtek RTL8723BS SDIO drivers;\n  - VME bus staging drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - DesignWare USB2 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB Dual Role (OTG-ready) Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C Port Controller Manager driver;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - 9P distributed file system;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - exFAT file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - Proc file system;\n  - SMB network file system;\n  - Tracing file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - BPF subsystem;\n  - Control group (cgroup);\n  - Glob pattern matching library;\n  - MAC80211 subsystem;\n  - Mellanox drivers;\n  - Networking core;\n  - Network sockets;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - Wireless networking;\n  - IPv4 networking;\n  - Netfilter;\n  - Network traffic control;\n  - SCTP protocol;\n  - TCP network protocol;\n  - XFRM subsystem;\n  - RDMA verbs API;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - Kernel CPU control infrastructure;\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Resizable hashtable library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - IEEE 802.15.4 subsystem;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - X.25 network layer;\n  - eXpress Data Path;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - SELinux security module;\n  - ALSA framework;\n  - HD-audio driver;\n  - QCOM ASoC drivers;\n  - Simple audio multiplexer codec driver;\n  - Texas InstrumentS Audio (ASoC/HDA) drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - Amlogic Meson SoC drivers;\n  - SOF drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n  - KVM subsystem;\n(CVE-2025-37807, CVE-2026-23265, CVE-2026-43022, CVE-2026-46321,\nCVE-2026-46322, CVE-2026-52917, CVE-2026-52923, CVE-2026-52927,\nCVE-2026-52929, CVE-2026-52935, CVE-2026-52942, CVE-2026-52943,\nCVE-2026-52947, CVE-2026-52994, CVE-2026-53136, CVE-2026-53137,\nCVE-2026-53138, CVE-2026-53143, CVE-2026-53146, CVE-2026-53147,\nCVE-2026-53149, CVE-2026-53156, CVE-2026-53157, CVE-2026-53160,\nCVE-2026-53161, CVE-2026-53184, CVE-2026-53189, CVE-2026-53194,\nCVE-2026-53195, CVE-2026-53199, CVE-2026-53202, CVE-2026-53205,\nCVE-2026-53209, CVE-2026-53223, CVE-2026-53229, CVE-2026-53253,\nCVE-2026-53255, CVE-2026-53267, CVE-2026-53268, CVE-2026-53272,\nCVE-2026-53329, CVE-2026-53330, CVE-2026-53356, CVE-2026-53362,\nCVE-2026-53365, CVE-2026-53366, CVE-2026-53381, CVE-2026-53383,\nCVE-2026-53387, CVE-2026-53388, CVE-2026-53389, CVE-2026-53390,\nCVE-2026-53391, CVE-2026-53392, CVE-2026-53397, CVE-2026-53400,\nCVE-2026-53401, CVE-2026-53402, CVE-2026-63794, CVE-2026-63802,\nCVE-2026-63803, CVE-2026-63805, CVE-2026-63806, CVE-2026-63809,\nCVE-2026-63812, CVE-2026-63814, CVE-2026-63816, CVE-2026-63817,\nCVE-2026-63819, CVE-2026-63823, CVE-2026-63824, CVE-2026-63827,\nCVE-2026-63833, CVE-2026-63867, CVE-2026-63869, CVE-2026-63870,\nCVE-2026-63875, CVE-2026-63879, CVE-2026-63881, CVE-2026-63884,\nCVE-2026-63889, CVE-2026-63909, CVE-2026-63913, CVE-2026-63920,\nCVE-2026-63925, CVE-2026-63927, CVE-2026-63930, CVE-2026-63942,\nCVE-2026-63954, CVE-2026-63968, CVE-2026-63970, CVE-2026-63971,\nCVE-2026-63985, CVE-2026-64002, CVE-2026-64003, CVE-2026-64004,\nCVE-2026-64005, CVE-2026-64009, CVE-2026-64017, CVE-2026-64023,\nCVE-2026-64026, CVE-2026-64036, CVE-2026-64095, CVE-2026-64123,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64210, CVE-2026-64222,\nCVE-2026-64239, CVE-2026-64242, CVE-2026-64243, CVE-2026-64245,\nCVE-2026-64246, CVE-2026-64266, CVE-2026-64270, CVE-2026-64271,\nCVE-2026-64272, CVE-2026-64273, CVE-2026-64274, CVE-2026-64276,\nCVE-2026-64277, CVE-2026-64279, CVE-2026-64283, CVE-2026-64286,\nCVE-2026-64287, CVE-2026-64296, CVE-2026-64298, CVE-2026-64299,\nCVE-2026-64304, CVE-2026-64312, CVE-2026-64317, CVE-2026-64318,\nCVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64333,\nCVE-2026-64368, CVE-2026-64372, CVE-2026-64374, CVE-2026-64375,\nCVE-2026-64378, CVE-2026-64379, CVE-2026-64380, CVE-2026-64388,\nCVE-2026-64389, CVE-2026-64395, CVE-2026-64398, CVE-2026-64401,\nCVE-2026-64402, CVE-2026-64403, CVE-2026-64411, CVE-2026-64412,\nCVE-2026-64413, CVE-2026-64418, CVE-2026-64420, CVE-2026-64422,\nCVE-2026-64423, CVE-2026-64430, CVE-2026-64432, CVE-2026-64435,\nCVE-2026-64436, CVE-2026-64440, CVE-2026-64442, CVE-2026-64443,\nCVE-2026-64444, CVE-2026-64448, CVE-2026-64449, CVE-2026-64452,\nCVE-2026-64456, CVE-2026-64463, CVE-2026-64468, CVE-2026-64469,\nCVE-2026-64481, CVE-2026-64496, CVE-2026-64524, CVE-2026-64532,\nCVE-2026-64533, CVE-2026-64536, CVE-2026-64539, CVE-2026-64540,\nCVE-2026-64543, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547,\nCVE-2026-64550, CVE-2026-64556, CVE-2026-64560, CVE-2026-64563,\nCVE-2026-64567, CVE-2026-64568, CVE-2026-64570, CVE-2026-64574,\nCVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64580,\nCVE-2026-64581, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584,\nCVE-2026-64585, CVE-2026-64599, CVE-2026-64600, CVE-2026-68091,\nCVE-2026-68096, CVE-2026-68097, CVE-2026-68098, CVE-2026-68100,\nCVE-2026-68104, CVE-2026-68106, CVE-2026-68107, CVE-2026-68108,\nCVE-2026-68116, CVE-2026-68118, CVE-2026-68119, CVE-2026-68121,\nCVE-2026-68125, CVE-2026-68129, CVE-2026-68131, CVE-2026-68140,\nCVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68145,\nCVE-2026-68148, CVE-2026-68149, CVE-2026-68153, CVE-2026-68155,\nCVE-2026-68157, CVE-2026-68178, CVE-2026-68179, CVE-2026-68189,\nCVE-2026-68192, CVE-2026-68196, CVE-2026-68199, CVE-2026-68202,\nCVE-2026-68204, CVE-2026-68216, CVE-2026-68219, CVE-2026-68222,\nCVE-2026-68236, CVE-2026-68245, CVE-2026-68253, CVE-2026-68255,\nCVE-2026-68258, CVE-2026-68260, CVE-2026-68262, CVE-2026-68263,\nCVE-2026-68266, CVE-2026-68273, CVE-2026-68284, CVE-2026-68287,\nCVE-2026-68290, CVE-2026-68293, CVE-2026-68294, CVE-2026-68297,\nCVE-2026-68299, CVE-2026-68314, CVE-2026-68315, CVE-2026-68320,\nCVE-2026-68322, CVE-2026-68323, CVE-2026-68326, CVE-2026-68329,\nCVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68348,\nCVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68370,\nCVE-2026-68371, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377,\nCVE-2026-68383, CVE-2026-68389, CVE-2026-68391, CVE-2026-68392,\nCVE-2026-68397, CVE-2026-68398, CVE-2026-68399, CVE-2026-68400,\nCVE-2026-68401, CVE-2026-68402, CVE-2026-68404, CVE-2026-68408,\nCVE-2026-68409, CVE-2026-68414, CVE-2026-68417, CVE-2026-68419,\nCVE-2026-68425, CVE-2026-68432, CVE-2026-68433, CVE-2026-68442,\nCVE-2026-68445, CVE-2026-68446, CVE-2026-68447, CVE-2026-68451,\nCVE-2026-68452, CVE-2026-68453, CVE-2026-68454, CVE-2026-68466,\nCVE-2026-68467, CVE-2026-68471, CVE-2026-68474, CVE-2026-68479,\nCVE-2026-72005, CVE-2026-72009, CVE-2026-72012, CVE-2026-72019,\nCVE-2026-72021, CVE-2026-72024, CVE-2026-72029, CVE-2026-72035,\nCVE-2026-72036, CVE-2026-72045, CVE-2026-72049, CVE-2026-72051,\nCVE-2026-72052, CVE-2026-72053, CVE-2026-72054, CVE-2026-72055,\nCVE-2026-72057, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067,\nCVE-2026-72072, CVE-2026-72089, CVE-2026-72099, CVE-2026-72102,\nCVE-2026-72105, CVE-2026-72107, CVE-2026-72108, CVE-2026-72109,\nCVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115,\nCVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119,\nCVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123,\nCVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72144,\nCVE-2026-72146, CVE-2026-72148, CVE-2026-72149, CVE-2026-72157,\nCVE-2026-72160, CVE-2026-72162, CVE-2026-72164, CVE-2026-72165,\nCVE-2026-72170, CVE-2026-72171, CVE-2026-72172, CVE-2026-72175,\nCVE-2026-72181, CVE-2026-72195, CVE-2026-72196, CVE-2026-72197,\nCVE-2026-72213, CVE-2026-72225, CVE-2026-72227, CVE-2026-72231,\nCVE-2026-72232, CVE-2026-72233, CVE-2026-72235, CVE-2026-72242,\nCVE-2026-72243, CVE-2026-72244, CVE-2026-72247, CVE-2026-72250,\nCVE-2026-72252, CVE-2026-72253, CVE-2026-72254, CVE-2026-72261,\nCVE-2026-72262, CVE-2026-72282, CVE-2026-72284, CVE-2026-72297,\nCVE-2026-72298, CVE-2026-72301, CVE-2026-72302, CVE-2026-72304,\nCVE-2026-72310, CVE-2026-72312, CVE-2026-72314, CVE-2026-72330,\nCVE-2026-72334, CVE-2026-72335, CVE-2026-72338, CVE-2026-72340,\nCVE-2026-72342, CVE-2026-72343, CVE-2026-72347, CVE-2026-72350,\nCVE-2026-72352, CVE-2026-72369, CVE-2026-72371, CVE-2026-72373,\nCVE-2026-72374, CVE-2026-72375, CVE-2026-72378, CVE-2026-72382,\nCVE-2026-72389, CVE-2026-72390, CVE-2026-72397, CVE-2026-72400,\nCVE-2026-72404, CVE-2026-72405, CVE-2026-72406, CVE-2026-72409,\nCVE-2026-72410, CVE-2026-72416, CVE-2026-72418, CVE-2026-72419,\nCVE-2026-72420, CVE-2026-72423, CVE-2026-72425, CVE-2026-72427,\nCVE-2026-72435, CVE-2026-72438, CVE-2026-72440, CVE-2026-72444,\nCVE-2026-72449, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460,\nCVE-2026-72464, CVE-2026-72469, CVE-2026-72470, CVE-2026-72476,\nCVE-2026-72478, CVE-2026-72480, CVE-2026-72483, CVE-2026-72485,\nCVE-2026-72492, CVE-2026-72502, CVE-2026-74256, CVE-2026-74257,\nCVE-2026-74258, CVE-2026-74262, CVE-2026-74270, CVE-2026-74281,\nCVE-2026-74282, CVE-2026-74283, CVE-2026-74288, CVE-2026-74289,\nCVE-2026-74292, CVE-2026-74293, CVE-2026-74294, CVE-2026-74295,\nCVE-2026-74296, CVE-2026-74297, CVE-2026-74300, CVE-2026-74312,\nCVE-2026-74313, CVE-2026-74314, CVE-2026-74317, CVE-2026-74321,\nCVE-2026-74330, CVE-2026-74334, CVE-2026-74338, CVE-2026-74340,\nCVE-2026-74341, CVE-2026-74344, CVE-2026-74347, CVE-2026-74349,\nCVE-2026-74356, CVE-2026-74359, CVE-2026-74363, CVE-2026-74365,\nCVE-2026-74374, CVE-2026-74375, CVE-2026-74377, CVE-2026-74378,\nCVE-2026-74380, CVE-2026-74385, CVE-2026-74387, CVE-2026-74388,\nCVE-2026-74390, CVE-2026-74397, CVE-2026-74438, CVE-2026-74443,\nCVE-2026-74444, CVE-2026-74446, CVE-2026-74450, CVE-2026-74453,\nCVE-2026-74454, CVE-2026-74456, CVE-2026-74461, CVE-2026-74465,\nCVE-2026-74467, CVE-2026-74469, CVE-2026-74470, CVE-2026-74471,\nCVE-2026-74479, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485,\nCVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74496,\nCVE-2026-74497, CVE-2026-74507, CVE-2026-74508, CVE-2026-74509,\nCVE-2026-74510, CVE-2026-74512, CVE-2026-74515, CVE-2026-74516,\nCVE-2026-74518, CVE-2026-74519, CVE-2026-74522, CVE-2026-74523,\nCVE-2026-74527, CVE-2026-74530, CVE-2026-74531, CVE-2026-74533,\nCVE-2026-74534, CVE-2026-74535, CVE-2026-74536, CVE-2026-74537,\nCVE-2026-74540, CVE-2026-74544, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74550, CVE-2026-74551, CVE-2026-74557, CVE-2026-74563,\nCVE-2026-74564, CVE-2026-74565, CVE-2026-74567, CVE-2026-74572,\nCVE-2026-74574, CVE-2026-74575, CVE-2026-74578, CVE-2026-74579,\nCVE-2026-74580, CVE-2026-74581, CVE-2026-74582, CVE-2026-74583,\nCVE-2026-74584, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588,\nCVE-2026-74589, CVE-2026-74590, CVE-2026-74592, CVE-2026-74594,\nCVE-2026-74595, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601,\nCVE-2026-74603, CVE-2026-74604, CVE-2026-74605, CVE-2026-74606,\nCVE-2026-74607, CVE-2026-74608, CVE-2026-74609, CVE-2026-74610,\nCVE-2026-74611, CVE-2026-74612, CVE-2026-74613, CVE-2026-74614,\nCVE-2026-74615, CVE-2026-74616, CVE-2026-74621, CVE-2026-74624,\nCVE-2026-74625, CVE-2026-74626, CVE-2026-74628, CVE-2026-74630,\nCVE-2026-74631, CVE-2026-74632, CVE-2026-74634, CVE-2026-74635,\nCVE-2026-74637, CVE-2026-74641, CVE-2026-74646, CVE-2026-74647,\nCVE-2026-74648, CVE-2026-74649, CVE-2026-74651, CVE-2026-74656,\nCVE-2026-74660, CVE-2026-74661, CVE-2026-74662, CVE-2026-74663,\nCVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669,\nCVE-2026-74670, CVE-2026-74675, CVE-2026-74678, CVE-2026-74684,\nCVE-2026-74687, CVE-2026-74688, CVE-2026-74689, CVE-2026-74690,\nCVE-2026-74691, CVE-2026-74692, CVE-2026-74695, CVE-2026-74696,\nCVE-2026-74697, CVE-2026-74700, CVE-2026-74701, CVE-2026-74704,\nCVE-2026-74705, CVE-2026-74710, CVE-2026-74711, CVE-2026-74713,\nCVE-2026-74714, CVE-2026-74715, CVE-2026-74717, CVE-2026-74720,\nCVE-2026-74723, CVE-2026-74724, CVE-2026-74725, CVE-2026-74726,\nCVE-2026-74730, CVE-2026-74733, CVE-2026-74736, CVE-2026-74737,\nCVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746,\nCVE-2026-74747, CVE-2026-74748, CVE-2026-74752, CVE-2026-80521,\nCVE-2026-80526, CVE-2026-80527, CVE-2026-80528, CVE-2026-80536,\nCVE-2026-80540, CVE-2026-80541, CVE-2026-80547, CVE-2026-80548,\nCVE-2026-80549, CVE-2026-80550, CVE-2026-80551, CVE-2026-80552,\nCVE-2026-80553, CVE-2026-80554, CVE-2026-80555, CVE-2026-80556,\nCVE-2026-80557, CVE-2026-80558, CVE-2026-80559, CVE-2026-80560,\nCVE-2026-80561, CVE-2026-80565, CVE-2026-80568, CVE-2026-80569,\nCVE-2026-80570, CVE-2026-80572, CVE-2026-80574, CVE-2026-80576,\nCVE-2026-80578, CVE-2026-80579, CVE-2026-80580, CVE-2026-80583,\nCVE-2026-80584, CVE-2026-80585, CVE-2026-80586, CVE-2026-80587,\nCVE-2026-80589, CVE-2026-80721, CVE-2026-80901, CVE-2026-97509)\n","status":"published","published":"2026-10-06T15:44:31Z","modified":"2026-11-09T12:49:02.511325613Z","updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"USN-8959-1","title":"linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - USB Gadget drivers;\n  - Memory management;\n  - Multiple devices driver;\n  - ARM64 architecture;\n  - EROFS file system;\n  - Networking core;\n  - eXpress Data Path;\n  - ARM32 architecture;\n  - M68K architecture;\n  - MIPS architecture;\n  - OpenRISC architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - Intel NPU Driver;\n  - Speakup Console Speech Driver;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Auxiliary display drivers;\n  - Drivers core;\n  - Micron PCIe SSD driver;\n  - Null block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - AMD CDX bus driver;\n  - Hardware random number generator core;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DIBS (Direct Internal Buffer Sharing) drivers;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - FireWire subsystem;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - Google firmware drivers;\n  - Qualcomm firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - HSI subsystem;\n  - Microsoft Hyper-V drivers;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - On-Chip Interconnect management framework;\n  - IOMMU subsystem;\n  - Industry Pack bus drivers;\n  - IRQ chip drivers;\n  - Mailbox framework;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Analog Devices digital potentiometer driver;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - Amazon Nitro Secure Module driver;\n  - SGI GRU driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - Operating Performance Points (OPP) driver;\n  - PA-RISC drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - Mellanox platform drivers;\n  - Microsoft Surface platform drivers;\n  - x86 platform drivers;\n  - MediaTek PM domains;\n  - Power sequencing drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - MPAM driver;\n  - RPMSG subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - USB DSL drivers;\n  - Cypress C67X00 USB driver;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - Intel La Jolla Cove Adapter USB driver;\n  - Intel USBIO USB I/O expander driver;\n  - USB Serial drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - ACRN Hypervisor Service Module driver;\n  - Virtio drivers;\n  - W1 Dallas's 1-wire bus driver;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - 9P distributed file system;\n  - File systems infrastructure;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - debug file system;\n  - eCrypt file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Overlay file system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UBI file system;\n  - UDF file system;\n  - XFS file system;\n  - BPF subsystem;\n  - Tracing infrastructure;\n  - Kernel futex primitives;\n  - Memory Management;\n  - VLANs driver;\n  - IPv4 networking;\n  - io_uring subsystem;\n  - KProbes tracing;\n  - KVM subsystem;\n  - Live Update Orchestrator (LUO);\n  - Netfilter;\n  - Perf events;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Networking subsytem;\n  - Slab allocator;\n  - Sun RPC protocol;\n  - Vector I/O iterator library;\n  - Virtio network driver;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IEEE 802.15.4 subsystem;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - NFC subsystem;\n  - SCTP protocol;\n  - Network sockets;\n  - TCP network protocol;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - Audit subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - DMA mapping infrastructure;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - IRQ subsystem;\n  - KCOV code coverage framework;\n  - Locking primitives;\n  - Kernel module support;\n  - Namespaces infrastructure;\n  - Kernel command line parsing driver;\n  - PID allocator;\n  - printk logging mechanism;\n  - System reboot mechanism;\n  - Timer subsystem;\n  - Workqueue subsystem;\n  - Kernel build system;\n  - Heterogeneous memory management;\n  - UCS-2 string library;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Devlink API;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - L2TP protocol;\n  - Logical Link layer;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - Netlink;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - PSP security protocol;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - XFRM subsystem;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Linux Security Modules (LSM) Framework;\n  - Key management;\n  - Landlock security;\n  - SELinux security module;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - Generic sound devices;\n  - HD-audio driver;\n  - ESS ES18xx ALSA driver;\n  - ICE1712/ICE1724 (Envy24) ALSA driver;\n  - Digigram PCXHR ALSA driver;\n  - AMD SoC Alsa drivers;\n  - Cirrus Logic audio codecs;\n  - QCOM ASoC drivers;\n  - Realtek audio codecs;\n  - Texas InstrumentS Audio (ASoC/HDA) drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - Amlogic Meson SoC drivers;\n  - Rockchip ASoC drivers;\n  - SoundWire (SDCA) ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Spreadtrum ASoC drivers;\n  - STI ASoC drivers;\n  - Xilinx ASoC drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n(CVE-2026-100070, CVE-2026-100071, CVE-2026-100072, CVE-2026-100073,\nCVE-2026-100074, CVE-2026-100075, CVE-2026-100076, CVE-2026-100077,\nCVE-2026-100078, CVE-2026-100079, CVE-2026-68451, CVE-2026-68452,\nCVE-2026-68453, CVE-2026-74440, CVE-2026-74441, CVE-2026-74442,\nCVE-2026-74443, CVE-2026-74444, CVE-2026-74445, CVE-2026-74446,\nCVE-2026-74447, CVE-2026-74448, CVE-2026-74449, CVE-2026-74450,\nCVE-2026-74451, CVE-2026-74452, CVE-2026-74453, CVE-2026-74454,\nCVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458,\nCVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74462,\nCVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74466,\nCVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74470,\nCVE-2026-74471, CVE-2026-74472, CVE-2026-74473, CVE-2026-74474,\nCVE-2026-74475, CVE-2026-74476, CVE-2026-74477, CVE-2026-74478,\nCVE-2026-74479, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482,\nCVE-2026-74483, CVE-2026-74484, CVE-2026-74485, CVE-2026-74486,\nCVE-2026-74487, CVE-2026-74488, CVE-2026-74490, CVE-2026-74491,\nCVE-2026-74492, CVE-2026-74493, CVE-2026-74494, CVE-2026-74495,\nCVE-2026-74496, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499,\nCVE-2026-74500, CVE-2026-74501, CVE-2026-74502, CVE-2026-74503,\nCVE-2026-74504, CVE-2026-74505, CVE-2026-74506, CVE-2026-74507,\nCVE-2026-74508, CVE-2026-74509, CVE-2026-74510, CVE-2026-74512,\nCVE-2026-74513, CVE-2026-74514, CVE-2026-74515, CVE-2026-74516,\nCVE-2026-74517, CVE-2026-74518, CVE-2026-74519, CVE-2026-74520,\nCVE-2026-74521, CVE-2026-74522, CVE-2026-74523, CVE-2026-74524,\nCVE-2026-74525, CVE-2026-74526, CVE-2026-74528, CVE-2026-74529,\nCVE-2026-74530, CVE-2026-74531, CVE-2026-74532, CVE-2026-74533,\nCVE-2026-74534, CVE-2026-74535, CVE-2026-74536, CVE-2026-74537,\nCVE-2026-74538, CVE-2026-74539, CVE-2026-74540, CVE-2026-74541,\nCVE-2026-74542, CVE-2026-74543, CVE-2026-74544, CVE-2026-74545,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74550, CVE-2026-74551, CVE-2026-74552, CVE-2026-74553,\nCVE-2026-74554, CVE-2026-74555, CVE-2026-74556, CVE-2026-74557,\nCVE-2026-74558, CVE-2026-74559, CVE-2026-74560, CVE-2026-74561,\nCVE-2026-74562, CVE-2026-74563, CVE-2026-74564, CVE-2026-74565,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74571,\nCVE-2026-74572, CVE-2026-74573, CVE-2026-74574, CVE-2026-74575,\nCVE-2026-74576, CVE-2026-74577, CVE-2026-74579, CVE-2026-74580,\nCVE-2026-74581, CVE-2026-74582, CVE-2026-74583, CVE-2026-74585,\nCVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589,\nCVE-2026-74590, CVE-2026-74591, CVE-2026-74592, CVE-2026-74593,\nCVE-2026-74594, CVE-2026-74595, CVE-2026-74596, CVE-2026-74597,\nCVE-2026-74598, CVE-2026-74599, CVE-2026-74600, CVE-2026-74601,\nCVE-2026-74602, CVE-2026-74603, CVE-2026-74604, CVE-2026-74605,\nCVE-2026-74606, CVE-2026-74607, CVE-2026-74608, CVE-2026-74609,\nCVE-2026-74610, CVE-2026-74611, CVE-2026-74612, CVE-2026-74613,\nCVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74617,\nCVE-2026-74618, CVE-2026-74619, CVE-2026-74620, CVE-2026-74621,\nCVE-2026-74622, CVE-2026-74623, CVE-2026-74624, CVE-2026-74625,\nCVE-2026-74626, CVE-2026-74627, CVE-2026-74628, CVE-2026-74629,\nCVE-2026-74630, CVE-2026-74631, CVE-2026-74632, CVE-2026-74633,\nCVE-2026-74634, CVE-2026-74635, CVE-2026-74636, CVE-2026-74637,\nCVE-2026-74638, CVE-2026-74639, CVE-2026-74640, CVE-2026-74641,\nCVE-2026-74643, CVE-2026-74644, CVE-2026-74645, CVE-2026-74646,\nCVE-2026-74647, CVE-2026-74648, CVE-2026-74649, CVE-2026-74650,\nCVE-2026-74651, CVE-2026-74652, CVE-2026-74653, CVE-2026-74654,\nCVE-2026-74655, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658,\nCVE-2026-74659, CVE-2026-74660, CVE-2026-74661, CVE-2026-74662,\nCVE-2026-74663, CVE-2026-74664, CVE-2026-74665, CVE-2026-74666,\nCVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74670,\nCVE-2026-74671, CVE-2026-74672, CVE-2026-74673, CVE-2026-74674,\nCVE-2026-74675, CVE-2026-74676, CVE-2026-74677, CVE-2026-74678,\nCVE-2026-74679, CVE-2026-74680, CVE-2026-74681, CVE-2026-74682,\nCVE-2026-74683, CVE-2026-74684, CVE-2026-74685, CVE-2026-74686,\nCVE-2026-74687, CVE-2026-74688, CVE-2026-74689, CVE-2026-74690,\nCVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694,\nCVE-2026-74695, CVE-2026-74696, CVE-2026-74697, CVE-2026-74698,\nCVE-2026-74699, CVE-2026-74700, CVE-2026-74701, CVE-2026-74702,\nCVE-2026-74703, CVE-2026-74704, CVE-2026-74705, CVE-2026-74706,\nCVE-2026-74707, CVE-2026-74708, CVE-2026-74709, CVE-2026-74710,\nCVE-2026-74711, CVE-2026-74712, CVE-2026-74713, CVE-2026-74714,\nCVE-2026-74715, CVE-2026-74716, CVE-2026-74717, CVE-2026-74718,\nCVE-2026-74719, CVE-2026-74720, CVE-2026-74721, CVE-2026-74722,\nCVE-2026-74723, CVE-2026-74724, CVE-2026-74725, CVE-2026-74726,\nCVE-2026-74727, CVE-2026-74728, CVE-2026-74729, CVE-2026-74730,\nCVE-2026-74733, CVE-2026-74734, CVE-2026-74735, CVE-2026-74736,\nCVE-2026-74737, CVE-2026-74738, CVE-2026-74739, CVE-2026-74740,\nCVE-2026-74741, CVE-2026-74742, CVE-2026-74743, CVE-2026-74744,\nCVE-2026-74745, CVE-2026-74746, CVE-2026-74747, CVE-2026-74748,\nCVE-2026-74750, CVE-2026-74752, CVE-2026-74753, CVE-2026-74754,\nCVE-2026-80519, CVE-2026-80520, CVE-2026-80521, CVE-2026-80522,\nCVE-2026-80523, CVE-2026-80524, CVE-2026-80525, CVE-2026-80526,\nCVE-2026-80527, CVE-2026-80528, CVE-2026-80529, CVE-2026-80530,\nCVE-2026-80531, CVE-2026-80532, CVE-2026-80533, CVE-2026-80534,\nCVE-2026-80535, CVE-2026-80536, CVE-2026-80537, CVE-2026-80538,\nCVE-2026-80539, CVE-2026-80540, CVE-2026-80541, CVE-2026-80542,\nCVE-2026-80547, CVE-2026-80548, CVE-2026-80549, CVE-2026-80550,\nCVE-2026-80551, CVE-2026-80552, CVE-2026-80553, CVE-2026-80554,\nCVE-2026-80555, CVE-2026-80556, CVE-2026-80557, CVE-2026-80558,\nCVE-2026-80559, CVE-2026-80560, CVE-2026-80561, CVE-2026-80562,\nCVE-2026-80563, CVE-2026-80564, CVE-2026-80565, CVE-2026-80566,\nCVE-2026-80567, CVE-2026-80568, CVE-2026-80569, CVE-2026-80570,\nCVE-2026-80571, CVE-2026-80572, CVE-2026-80573, CVE-2026-80574,\nCVE-2026-80575, CVE-2026-80576, CVE-2026-80577, CVE-2026-80578,\nCVE-2026-80579, CVE-2026-80580, CVE-2026-80581, CVE-2026-80582,\nCVE-2026-80583, CVE-2026-80584, CVE-2026-80585, CVE-2026-80586,\nCVE-2026-80587, CVE-2026-80588, CVE-2026-80589, CVE-2026-80590,\nCVE-2026-80678, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681,\nCVE-2026-80683, CVE-2026-80684, CVE-2026-80685, CVE-2026-80686,\nCVE-2026-80687, CVE-2026-80688, CVE-2026-80689, CVE-2026-80690,\nCVE-2026-80691, CVE-2026-80692, CVE-2026-80693, CVE-2026-80694,\nCVE-2026-80695, CVE-2026-80696, CVE-2026-80697, CVE-2026-80698,\nCVE-2026-80699, CVE-2026-80700, CVE-2026-80701, CVE-2026-80702,\nCVE-2026-80703, CVE-2026-80704, CVE-2026-80705, CVE-2026-80706,\nCVE-2026-80707, CVE-2026-80708, CVE-2026-80709, CVE-2026-80710,\nCVE-2026-80711, CVE-2026-80712, CVE-2026-80713, CVE-2026-80714,\nCVE-2026-80715, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718,\nCVE-2026-80720, CVE-2026-80721, CVE-2026-80722, CVE-2026-80723,\nCVE-2026-80724, CVE-2026-80727, CVE-2026-80729, CVE-2026-80730,\nCVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80734,\nCVE-2026-80735, CVE-2026-80736, CVE-2026-80737, CVE-2026-80738,\nCVE-2026-80739, CVE-2026-80740, CVE-2026-80741, CVE-2026-80742,\nCVE-2026-80743, CVE-2026-80744, CVE-2026-80745, CVE-2026-80747,\nCVE-2026-80748, CVE-2026-80749, CVE-2026-80750, CVE-2026-80751,\nCVE-2026-80752, CVE-2026-80753, CVE-2026-80754, CVE-2026-80755,\nCVE-2026-80756, CVE-2026-80757, CVE-2026-80758, CVE-2026-80759,\nCVE-2026-80760, CVE-2026-80761, CVE-2026-80762, CVE-2026-80763,\nCVE-2026-80764, CVE-2026-80765, CVE-2026-80766, CVE-2026-80767,\nCVE-2026-80768, CVE-2026-80769, CVE-2026-80770, CVE-2026-80771,\nCVE-2026-80772, CVE-2026-80774, CVE-2026-80775, CVE-2026-80776,\nCVE-2026-80777, CVE-2026-80778, CVE-2026-80779, CVE-2026-80780,\nCVE-2026-80781, CVE-2026-80782, CVE-2026-80783, CVE-2026-80784,\nCVE-2026-80785, CVE-2026-80786, CVE-2026-80787, CVE-2026-80788,\nCVE-2026-80789, CVE-2026-80790, CVE-2026-80791, CVE-2026-80792,\nCVE-2026-80793, CVE-2026-80794, CVE-2026-80795, CVE-2026-80796,\nCVE-2026-80797, CVE-2026-80798, CVE-2026-80799, CVE-2026-80800,\nCVE-2026-80801, CVE-2026-80802, CVE-2026-80803, CVE-2026-80804,\nCVE-2026-80805, CVE-2026-80806, CVE-2026-80807, CVE-2026-80808,\nCVE-2026-80809, CVE-2026-80810, CVE-2026-80811, CVE-2026-80812,\nCVE-2026-80813, CVE-2026-80814, CVE-2026-80815, CVE-2026-80816,\nCVE-2026-80817, CVE-2026-80818, CVE-2026-80819, CVE-2026-80820,\nCVE-2026-80821, CVE-2026-80822, CVE-2026-80823, CVE-2026-80824,\nCVE-2026-80825, CVE-2026-80826, CVE-2026-80827, CVE-2026-80828,\nCVE-2026-80829, CVE-2026-80830, CVE-2026-80831, CVE-2026-80832,\nCVE-2026-80833, CVE-2026-80834, CVE-2026-80835, CVE-2026-80836,\nCVE-2026-80837, CVE-2026-80838, CVE-2026-80839, CVE-2026-80840,\nCVE-2026-80841, CVE-2026-80842, CVE-2026-80843, CVE-2026-80844,\nCVE-2026-80845, CVE-2026-80846, CVE-2026-80847, CVE-2026-80848,\nCVE-2026-80849, CVE-2026-80850, CVE-2026-80851, CVE-2026-80852,\nCVE-2026-80854, CVE-2026-80855, CVE-2026-80856, CVE-2026-80857,\nCVE-2026-80858, CVE-2026-80859, CVE-2026-80860, CVE-2026-80861,\nCVE-2026-80862, CVE-2026-80863, CVE-2026-80864, CVE-2026-80887,\nCVE-2026-80888, CVE-2026-80889, CVE-2026-80890, CVE-2026-80891,\nCVE-2026-80892, CVE-2026-80893, CVE-2026-80894, CVE-2026-80895,\nCVE-2026-80896, CVE-2026-80897, CVE-2026-80898, CVE-2026-80899,\nCVE-2026-80900, CVE-2026-80901, CVE-2026-80902, CVE-2026-80903,\nCVE-2026-80904, CVE-2026-80905, CVE-2026-80906, CVE-2026-80907,\nCVE-2026-80908, CVE-2026-80909, CVE-2026-80910, CVE-2026-80911,\nCVE-2026-80912, CVE-2026-80913, CVE-2026-80914, CVE-2026-80915,\nCVE-2026-80916, CVE-2026-80917, CVE-2026-80918, CVE-2026-80920,\nCVE-2026-80921, CVE-2026-80922, CVE-2026-80923, CVE-2026-80924,\nCVE-2026-80925, CVE-2026-80926, CVE-2026-80927, CVE-2026-80928,\nCVE-2026-80929, CVE-2026-80930, CVE-2026-80931, CVE-2026-80932,\nCVE-2026-80933, CVE-2026-80934, CVE-2026-80935, CVE-2026-80936,\nCVE-2026-80937, CVE-2026-80938, CVE-2026-80939, CVE-2026-80940,\nCVE-2026-80941, CVE-2026-80942, CVE-2026-80943, CVE-2026-80944,\nCVE-2026-80945, CVE-2026-80946, CVE-2026-80947, CVE-2026-80948,\nCVE-2026-80949, CVE-2026-80950, CVE-2026-80951, CVE-2026-80952,\nCVE-2026-80953, CVE-2026-80954, CVE-2026-80955, CVE-2026-80956,\nCVE-2026-80957, CVE-2026-80958, CVE-2026-80959, CVE-2026-80960,\nCVE-2026-80961, CVE-2026-80962, CVE-2026-80963, CVE-2026-80964,\nCVE-2026-80965, CVE-2026-80966, CVE-2026-80967, CVE-2026-80968,\nCVE-2026-80969, CVE-2026-80970, CVE-2026-80971, CVE-2026-80972,\nCVE-2026-80973, CVE-2026-80974, CVE-2026-80975, CVE-2026-80976,\nCVE-2026-80977, CVE-2026-80978, CVE-2026-80979, CVE-2026-80980,\nCVE-2026-80981, CVE-2026-80982, CVE-2026-80983, CVE-2026-80984,\nCVE-2026-80985, CVE-2026-80986, CVE-2026-80987, CVE-2026-80988,\nCVE-2026-80989, CVE-2026-80990, CVE-2026-80991, CVE-2026-80992,\nCVE-2026-80993, CVE-2026-80994, CVE-2026-80996, CVE-2026-80997,\nCVE-2026-80999, CVE-2026-81000, CVE-2026-81001, CVE-2026-81002,\nCVE-2026-81003, CVE-2026-81004, CVE-2026-81005, CVE-2026-81006,\nCVE-2026-81007, CVE-2026-81008, CVE-2026-81009, CVE-2026-81010,\nCVE-2026-81011, CVE-2026-81012, CVE-2026-81013, CVE-2026-81014,\nCVE-2026-81015, CVE-2026-81016, CVE-2026-81017, CVE-2026-81018,\nCVE-2026-89437, CVE-2026-89438, CVE-2026-89439, CVE-2026-89440,\nCVE-2026-89441, CVE-2026-89442, CVE-2026-89443, CVE-2026-89444,\nCVE-2026-89445, CVE-2026-89446, CVE-2026-89447, CVE-2026-89448,\nCVE-2026-89449, CVE-2026-89450, CVE-2026-89451, CVE-2026-89452,\nCVE-2026-89453, CVE-2026-89454, CVE-2026-89455, CVE-2026-89456,\nCVE-2026-89457, CVE-2026-89458, CVE-2026-89460, CVE-2026-89461,\nCVE-2026-89462, CVE-2026-89463, CVE-2026-89464, CVE-2026-89465,\nCVE-2026-89466, CVE-2026-89467, CVE-2026-89468, CVE-2026-89469,\nCVE-2026-89470, CVE-2026-89471, CVE-2026-89472, CVE-2026-89473,\nCVE-2026-89474, CVE-2026-89475, CVE-2026-89476, CVE-2026-89477,\nCVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481,\nCVE-2026-89482, CVE-2026-89483, CVE-2026-89484, CVE-2026-89485,\nCVE-2026-89486, CVE-2026-89487, CVE-2026-89488, CVE-2026-89489,\nCVE-2026-89490, CVE-2026-89491, CVE-2026-89492, CVE-2026-89493,\nCVE-2026-89494, CVE-2026-89495, CVE-2026-89496, CVE-2026-89497,\nCVE-2026-89498, CVE-2026-89500, CVE-2026-89501, CVE-2026-89502,\nCVE-2026-89503, CVE-2026-89504, CVE-2026-89506, CVE-2026-89507,\nCVE-2026-89508, CVE-2026-89509, CVE-2026-89510, CVE-2026-89511,\nCVE-2026-89512, CVE-2026-89513, CVE-2026-89514, CVE-2026-89515,\nCVE-2026-89520, CVE-2026-89521, CVE-2026-89522, CVE-2026-89523,\nCVE-2026-89524, CVE-2026-89525, CVE-2026-89526, CVE-2026-89527,\nCVE-2026-89528, CVE-2026-89529, CVE-2026-89530, CVE-2026-89531,\nCVE-2026-89532, CVE-2026-89533, CVE-2026-89534, CVE-2026-89535,\nCVE-2026-89536, CVE-2026-89537, CVE-2026-89538, CVE-2026-89539,\nCVE-2026-89540, CVE-2026-89541, CVE-2026-89542, CVE-2026-89543,\nCVE-2026-89544, CVE-2026-89545, CVE-2026-89546, CVE-2026-89547,\nCVE-2026-89548, CVE-2026-89549, CVE-2026-89550, CVE-2026-89551,\nCVE-2026-89552, CVE-2026-89553, CVE-2026-89554, CVE-2026-89555,\nCVE-2026-89556, CVE-2026-89557, CVE-2026-89558, CVE-2026-89559,\nCVE-2026-89560, CVE-2026-89561, CVE-2026-89562, CVE-2026-89563,\nCVE-2026-89564, CVE-2026-89565, CVE-2026-89566, CVE-2026-89567,\nCVE-2026-89569, CVE-2026-89570, CVE-2026-89571, CVE-2026-89572,\nCVE-2026-89573, CVE-2026-89574, CVE-2026-89575, CVE-2026-89576,\nCVE-2026-89577, CVE-2026-89578, CVE-2026-89579, CVE-2026-89580,\nCVE-2026-89581, CVE-2026-89582, CVE-2026-89583, CVE-2026-89584,\nCVE-2026-89585, CVE-2026-89586, CVE-2026-89587, CVE-2026-89588,\nCVE-2026-89589, CVE-2026-89590, CVE-2026-89591, CVE-2026-89592,\nCVE-2026-89593, CVE-2026-89594, CVE-2026-89595, CVE-2026-89596,\nCVE-2026-89597, CVE-2026-89598, CVE-2026-89599, CVE-2026-89600,\nCVE-2026-89601, CVE-2026-89602, CVE-2026-89604, CVE-2026-89605,\nCVE-2026-89606, CVE-2026-89607, CVE-2026-89608, CVE-2026-89609,\nCVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89618,\nCVE-2026-89619, CVE-2026-89620, CVE-2026-89621, CVE-2026-89622,\nCVE-2026-89623, CVE-2026-89624, CVE-2026-89625, CVE-2026-89626,\nCVE-2026-89627, CVE-2026-89628, CVE-2026-89629, CVE-2026-89630,\nCVE-2026-89631, CVE-2026-89632, CVE-2026-89633, CVE-2026-89634,\nCVE-2026-89636, CVE-2026-89637, CVE-2026-89638, CVE-2026-89640,\nCVE-2026-89641, CVE-2026-89642, CVE-2026-89643, CVE-2026-89644,\nCVE-2026-89645, CVE-2026-89646, CVE-2026-89647, CVE-2026-89648,\nCVE-2026-89649, CVE-2026-89650, CVE-2026-89651, CVE-2026-89652,\nCVE-2026-89653, CVE-2026-89654, CVE-2026-89655, CVE-2026-89656,\nCVE-2026-89657, CVE-2026-89658, CVE-2026-89659, CVE-2026-89660,\nCVE-2026-89661, CVE-2026-89662, CVE-2026-89663, CVE-2026-89664,\nCVE-2026-89665, CVE-2026-89666, CVE-2026-89667, CVE-2026-89668,\nCVE-2026-89669, CVE-2026-89670, CVE-2026-89671, CVE-2026-89672,\nCVE-2026-89673, CVE-2026-89674, CVE-2026-89675, CVE-2026-89676,\nCVE-2026-89677, CVE-2026-89678, CVE-2026-89679, CVE-2026-89680,\nCVE-2026-89682, CVE-2026-89683, CVE-2026-89684, CVE-2026-89685,\nCVE-2026-89686, CVE-2026-89687, CVE-2026-89688, CVE-2026-89689,\nCVE-2026-89690, CVE-2026-89691, CVE-2026-89692, CVE-2026-89693,\nCVE-2026-89694, CVE-2026-89695, CVE-2026-89696, CVE-2026-89697,\nCVE-2026-89698, CVE-2026-89699, CVE-2026-89700, CVE-2026-89701,\nCVE-2026-89702, CVE-2026-89703, CVE-2026-89704, CVE-2026-89705,\nCVE-2026-89706, CVE-2026-89707, CVE-2026-89708, CVE-2026-89709,\nCVE-2026-89710, CVE-2026-89711, CVE-2026-89712, CVE-2026-89713,\nCVE-2026-89714, CVE-2026-89715, CVE-2026-89716, CVE-2026-89717,\nCVE-2026-89718, CVE-2026-89719, CVE-2026-89720, CVE-2026-89721,\nCVE-2026-89722, CVE-2026-89723, CVE-2026-89724, CVE-2026-89725,\nCVE-2026-89726, CVE-2026-89727, CVE-2026-89728, CVE-2026-89729,\nCVE-2026-89730, CVE-2026-89731, CVE-2026-89732, CVE-2026-89733,\nCVE-2026-89734, CVE-2026-89735, CVE-2026-89736, CVE-2026-89737,\nCVE-2026-89738, CVE-2026-89739, CVE-2026-89740, CVE-2026-89741,\nCVE-2026-89742, CVE-2026-89743, CVE-2026-89744, CVE-2026-89745,\nCVE-2026-89746, CVE-2026-89747, CVE-2026-89749, CVE-2026-89750,\nCVE-2026-89751, CVE-2026-89752, CVE-2026-89753, CVE-2026-89754,\nCVE-2026-89755, CVE-2026-89756, CVE-2026-89757, CVE-2026-89758,\nCVE-2026-89759, CVE-2026-89761, CVE-2026-89762, CVE-2026-89763,\nCVE-2026-89765, CVE-2026-89766, CVE-2026-89767, CVE-2026-89768,\nCVE-2026-89769, CVE-2026-89771, CVE-2026-89775, CVE-2026-89776,\nCVE-2026-89777, CVE-2026-89778, CVE-2026-89779, CVE-2026-89780,\nCVE-2026-89781, CVE-2026-89782, CVE-2026-89783, CVE-2026-89784,\nCVE-2026-89785, CVE-2026-89786, CVE-2026-89787, CVE-2026-89788,\nCVE-2026-89789, CVE-2026-89790, CVE-2026-89791, CVE-2026-89792,\nCVE-2026-89793, CVE-2026-89794, CVE-2026-89795, CVE-2026-89796,\nCVE-2026-89797, CVE-2026-89798, CVE-2026-89799, CVE-2026-89800,\nCVE-2026-89801, CVE-2026-89802, CVE-2026-89803, CVE-2026-89804,\nCVE-2026-89806, CVE-2026-89807, CVE-2026-89808, CVE-2026-89809,\nCVE-2026-89810, CVE-2026-89811, CVE-2026-89812, CVE-2026-89813,\nCVE-2026-89814, CVE-2026-89815, CVE-2026-89816, CVE-2026-89817,\nCVE-2026-89818, CVE-2026-89819, CVE-2026-89820, CVE-2026-89821,\nCVE-2026-89822, CVE-2026-89823, CVE-2026-89824, CVE-2026-89825,\nCVE-2026-89826, CVE-2026-89827, CVE-2026-89828, CVE-2026-89829,\nCVE-2026-89830, CVE-2026-89831, CVE-2026-89832, CVE-2026-89833,\nCVE-2026-89834, CVE-2026-89835, CVE-2026-89836, CVE-2026-89837,\nCVE-2026-89838, CVE-2026-89839, CVE-2026-89840, CVE-2026-89841,\nCVE-2026-89842, CVE-2026-89843, CVE-2026-89844, CVE-2026-89845,\nCVE-2026-89846, CVE-2026-89847, CVE-2026-89848, CVE-2026-89849,\nCVE-2026-89850, CVE-2026-89851, CVE-2026-89852, CVE-2026-89853,\nCVE-2026-89854, CVE-2026-89855, CVE-2026-89856, CVE-2026-89857,\nCVE-2026-89858, CVE-2026-89859, CVE-2026-89860, CVE-2026-89861,\nCVE-2026-89862, CVE-2026-89863, CVE-2026-89864, CVE-2026-89865,\nCVE-2026-89866, CVE-2026-89867, CVE-2026-89868, CVE-2026-89869,\nCVE-2026-89870, CVE-2026-89871, CVE-2026-89872, CVE-2026-89873,\nCVE-2026-89874, CVE-2026-89875, CVE-2026-89876, CVE-2026-89877,\nCVE-2026-89878, CVE-2026-89879, CVE-2026-89880, CVE-2026-89881,\nCVE-2026-89882, CVE-2026-89883, CVE-2026-89884, CVE-2026-89885,\nCVE-2026-89886, CVE-2026-89887, CVE-2026-89888, CVE-2026-89889,\nCVE-2026-89890, CVE-2026-89891, CVE-2026-89892, CVE-2026-89893,\nCVE-2026-89894, CVE-2026-89895, CVE-2026-89896, CVE-2026-89897,\nCVE-2026-89898, CVE-2026-89899, CVE-2026-89901, CVE-2026-89902,\nCVE-2026-89903, CVE-2026-89904, CVE-2026-89905, CVE-2026-89906,\nCVE-2026-89908, CVE-2026-89909, CVE-2026-89911, CVE-2026-89912,\nCVE-2026-89913, CVE-2026-89914, CVE-2026-89915, CVE-2026-89916,\nCVE-2026-89917, CVE-2026-89918, CVE-2026-89919, CVE-2026-89920,\nCVE-2026-89921, CVE-2026-89922, CVE-2026-89923, CVE-2026-89924,\nCVE-2026-89925, CVE-2026-89926, CVE-2026-89927, CVE-2026-89928,\nCVE-2026-89929, CVE-2026-89930, CVE-2026-89931, CVE-2026-89932,\nCVE-2026-89933, CVE-2026-89934, CVE-2026-89935, CVE-2026-89936,\nCVE-2026-89937, CVE-2026-89938, CVE-2026-89939, CVE-2026-89940,\nCVE-2026-89941, CVE-2026-89942, CVE-2026-89944, CVE-2026-89945,\nCVE-2026-89946, CVE-2026-89947, CVE-2026-89948, CVE-2026-89949,\nCVE-2026-89950, CVE-2026-89951, CVE-2026-89952, CVE-2026-89953,\nCVE-2026-89954, CVE-2026-89955, CVE-2026-89956, CVE-2026-89957,\nCVE-2026-89958, CVE-2026-89959, CVE-2026-89960, CVE-2026-89961,\nCVE-2026-89962, CVE-2026-89963, CVE-2026-89964, CVE-2026-89965,\nCVE-2026-89966, CVE-2026-89967, CVE-2026-89968, CVE-2026-89969,\nCVE-2026-89970, CVE-2026-89971, CVE-2026-89972, CVE-2026-89973,\nCVE-2026-89974, CVE-2026-89975, CVE-2026-89976, CVE-2026-89977,\nCVE-2026-89978, CVE-2026-89979, CVE-2026-89981, CVE-2026-89982,\nCVE-2026-89983, CVE-2026-89984, CVE-2026-89986, CVE-2026-89987,\nCVE-2026-89988, CVE-2026-89989, CVE-2026-89990, CVE-2026-89991,\nCVE-2026-89992, CVE-2026-89993, CVE-2026-89994, CVE-2026-89995,\nCVE-2026-89996, CVE-2026-89997, CVE-2026-89998, CVE-2026-89999,\nCVE-2026-90000, CVE-2026-90001, CVE-2026-90002, CVE-2026-90003,\nCVE-2026-90005, CVE-2026-90006, CVE-2026-90007, CVE-2026-90008,\nCVE-2026-90011, CVE-2026-90012, CVE-2026-90013, CVE-2026-90014,\nCVE-2026-90015, CVE-2026-90016, CVE-2026-90017, CVE-2026-90018,\nCVE-2026-90019, CVE-2026-90020, CVE-2026-90021, CVE-2026-90022,\nCVE-2026-90023, CVE-2026-90024, CVE-2026-90025, CVE-2026-90026,\nCVE-2026-90027, CVE-2026-90028, CVE-2026-90029, CVE-2026-90030,\nCVE-2026-90031, CVE-2026-90032, CVE-2026-90033, CVE-2026-90034,\nCVE-2026-90035, CVE-2026-90036, CVE-2026-90037, CVE-2026-90039,\nCVE-2026-90040, CVE-2026-90041, CVE-2026-90042, CVE-2026-90043,\nCVE-2026-90044, CVE-2026-90045, CVE-2026-90046, CVE-2026-90047,\nCVE-2026-90048, CVE-2026-90049, CVE-2026-90051, CVE-2026-90053,\nCVE-2026-90054, CVE-2026-90055, CVE-2026-90056, CVE-2026-90057,\nCVE-2026-90058, CVE-2026-90059, CVE-2026-90060, CVE-2026-90061,\nCVE-2026-90062, CVE-2026-90063, CVE-2026-90065, CVE-2026-90066,\nCVE-2026-90067, CVE-2026-90068, CVE-2026-90069, CVE-2026-90070,\nCVE-2026-90071, CVE-2026-90072, CVE-2026-90073, CVE-2026-90074,\nCVE-2026-90075, CVE-2026-90076, CVE-2026-90077, CVE-2026-90078,\nCVE-2026-90079, CVE-2026-90080, CVE-2026-90081, CVE-2026-90082,\nCVE-2026-90083, CVE-2026-90084, CVE-2026-90085, CVE-2026-90086,\nCVE-2026-90087, CVE-2026-90088, CVE-2026-90089, CVE-2026-90090,\nCVE-2026-90091, CVE-2026-90092, CVE-2026-90093, CVE-2026-90094,\nCVE-2026-90095, CVE-2026-90097, CVE-2026-90099, CVE-2026-90100,\nCVE-2026-90101, CVE-2026-90102, CVE-2026-90103, CVE-2026-90104,\nCVE-2026-90105, CVE-2026-90106, CVE-2026-90107, CVE-2026-90108,\nCVE-2026-90109, CVE-2026-90110, CVE-2026-90111, CVE-2026-90112,\nCVE-2026-90113, CVE-2026-90114, CVE-2026-90115, CVE-2026-90116,\nCVE-2026-90119, CVE-2026-90120, CVE-2026-90121, CVE-2026-90122,\nCVE-2026-90124, CVE-2026-90125, CVE-2026-90126, CVE-2026-90127,\nCVE-2026-90128, CVE-2026-90129, CVE-2026-90130, CVE-2026-90135,\nCVE-2026-90136, CVE-2026-90137, CVE-2026-90138, CVE-2026-90139,\nCVE-2026-90140, CVE-2026-90141, CVE-2026-90142, CVE-2026-90143,\nCVE-2026-90145, CVE-2026-90146, CVE-2026-90147, CVE-2026-90148,\nCVE-2026-90149, CVE-2026-90150, CVE-2026-90151, CVE-2026-90152,\nCVE-2026-90153, CVE-2026-90154, CVE-2026-90156, CVE-2026-90157,\nCVE-2026-90158, CVE-2026-90159, CVE-2026-90160, CVE-2026-90161,\nCVE-2026-90163, CVE-2026-90164, CVE-2026-90165, CVE-2026-90166,\nCVE-2026-90169, CVE-2026-90170, CVE-2026-90174, CVE-2026-90175,\nCVE-2026-90176, CVE-2026-90177, CVE-2026-90178, CVE-2026-90179,\nCVE-2026-90180, CVE-2026-90182, CVE-2026-90183, CVE-2026-90184,\nCVE-2026-90185, CVE-2026-90186, CVE-2026-90187, CVE-2026-90188,\nCVE-2026-90189, CVE-2026-90190, CVE-2026-90191, CVE-2026-90192,\nCVE-2026-90193, CVE-2026-90194, CVE-2026-90195, CVE-2026-90196,\nCVE-2026-90197, CVE-2026-90198, CVE-2026-90199, CVE-2026-90200,\nCVE-2026-90201, CVE-2026-90202, CVE-2026-90203, CVE-2026-90204,\nCVE-2026-90205, CVE-2026-90206, CVE-2026-90207, CVE-2026-90208,\nCVE-2026-90209, CVE-2026-90211, CVE-2026-90212, CVE-2026-90213,\nCVE-2026-90214, CVE-2026-90215, CVE-2026-90216, CVE-2026-90217,\nCVE-2026-90218, CVE-2026-90219, CVE-2026-90220, CVE-2026-90221,\nCVE-2026-90222, CVE-2026-90223, CVE-2026-90224, CVE-2026-90225,\nCVE-2026-90226, CVE-2026-90227, CVE-2026-90228, CVE-2026-90229,\nCVE-2026-90230, CVE-2026-90231, CVE-2026-90232, CVE-2026-90233,\nCVE-2026-90234, CVE-2026-90235, CVE-2026-90237, CVE-2026-90240,\nCVE-2026-90241, CVE-2026-90242, CVE-2026-90243, CVE-2026-90244,\nCVE-2026-90245, CVE-2026-90246, CVE-2026-90247, CVE-2026-90248,\nCVE-2026-90249, CVE-2026-90250, CVE-2026-90251, CVE-2026-90252,\nCVE-2026-90253, CVE-2026-90254, CVE-2026-90255, CVE-2026-90256,\nCVE-2026-90257, CVE-2026-90258, CVE-2026-90259, CVE-2026-90260,\nCVE-2026-90261, CVE-2026-90262, CVE-2026-90263, CVE-2026-90264,\nCVE-2026-90265, CVE-2026-90267, CVE-2026-90269, CVE-2026-90270,\nCVE-2026-90271, CVE-2026-90272, CVE-2026-90273, CVE-2026-90274,\nCVE-2026-90275, CVE-2026-90276, CVE-2026-90277, CVE-2026-90278,\nCVE-2026-90279, CVE-2026-90280, CVE-2026-90281, CVE-2026-90282,\nCVE-2026-90283, CVE-2026-90284, CVE-2026-90285, CVE-2026-90286,\nCVE-2026-90287, CVE-2026-90288, CVE-2026-90289, CVE-2026-90290,\nCVE-2026-90291, CVE-2026-90292, CVE-2026-90293, CVE-2026-90294,\nCVE-2026-90295, CVE-2026-90296, CVE-2026-90297, CVE-2026-90298,\nCVE-2026-90300, CVE-2026-90301, CVE-2026-90302, CVE-2026-90303,\nCVE-2026-90306, CVE-2026-90307, CVE-2026-90308, CVE-2026-90309,\nCVE-2026-90311, CVE-2026-90312, CVE-2026-90313, CVE-2026-90314,\nCVE-2026-90315, CVE-2026-90316, CVE-2026-90318, CVE-2026-90319,\nCVE-2026-90320, CVE-2026-90321, CVE-2026-90322, CVE-2026-90323,\nCVE-2026-90324, CVE-2026-90325, CVE-2026-90326, CVE-2026-90327,\nCVE-2026-90328, CVE-2026-90329, CVE-2026-90330, CVE-2026-90331,\nCVE-2026-90332, CVE-2026-90333, CVE-2026-90334, CVE-2026-90335,\nCVE-2026-90336, CVE-2026-90337, CVE-2026-90338, CVE-2026-90341,\nCVE-2026-90342, CVE-2026-90343, CVE-2026-90344, CVE-2026-90345,\nCVE-2026-90346, CVE-2026-90347, CVE-2026-90348, CVE-2026-90349,\nCVE-2026-90350, CVE-2026-90351, CVE-2026-90352, CVE-2026-90353,\nCVE-2026-90354, CVE-2026-90355, CVE-2026-90356, CVE-2026-90357,\nCVE-2026-90358, CVE-2026-90359, CVE-2026-90360, CVE-2026-90361,\nCVE-2026-90362, CVE-2026-90363, CVE-2026-90364, CVE-2026-90365,\nCVE-2026-90366, CVE-2026-90367, CVE-2026-90368, CVE-2026-90369,\nCVE-2026-90370, CVE-2026-90371, CVE-2026-90372, CVE-2026-90373,\nCVE-2026-90374, CVE-2026-90375, CVE-2026-90376, CVE-2026-90377,\nCVE-2026-90378, CVE-2026-90379, CVE-2026-90380, CVE-2026-90381,\nCVE-2026-90382, CVE-2026-90383, CVE-2026-90384, CVE-2026-90385,\nCVE-2026-90386, CVE-2026-90387, CVE-2026-90388, CVE-2026-90389,\nCVE-2026-90390, CVE-2026-90391, CVE-2026-90392, CVE-2026-90393,\nCVE-2026-90394, CVE-2026-90395, CVE-2026-90396, CVE-2026-90397,\nCVE-2026-90398, CVE-2026-90399, CVE-2026-90400, CVE-2026-90401,\nCVE-2026-90402, CVE-2026-90403, CVE-2026-90404, CVE-2026-90406,\nCVE-2026-90407, CVE-2026-90408, CVE-2026-90409, CVE-2026-90410,\nCVE-2026-90411, CVE-2026-90412, CVE-2026-90413, CVE-2026-90414,\nCVE-2026-90415, CVE-2026-90416, CVE-2026-90417, CVE-2026-90418,\nCVE-2026-90419, CVE-2026-90420, CVE-2026-90421, CVE-2026-90422,\nCVE-2026-90423, CVE-2026-90424, CVE-2026-90425, CVE-2026-90426,\nCVE-2026-90427, CVE-2026-90428, CVE-2026-90429, CVE-2026-90430,\nCVE-2026-90431, CVE-2026-90433, CVE-2026-90434, CVE-2026-90435,\nCVE-2026-92476, CVE-2026-92477, CVE-2026-92479, CVE-2026-92480,\nCVE-2026-92481, CVE-2026-92482, CVE-2026-92483, CVE-2026-92484,\nCVE-2026-92485, CVE-2026-92486, CVE-2026-92488, CVE-2026-92489,\nCVE-2026-92490, CVE-2026-92491, CVE-2026-92493, CVE-2026-92494,\nCVE-2026-92495, CVE-2026-92496, CVE-2026-92497, CVE-2026-92498,\nCVE-2026-92499, CVE-2026-92500, CVE-2026-92501, CVE-2026-92503,\nCVE-2026-92504, CVE-2026-92505, CVE-2026-92506, CVE-2026-92507,\nCVE-2026-92508, CVE-2026-92509, CVE-2026-92510, CVE-2026-92511,\nCVE-2026-92512, CVE-2026-92513, CVE-2026-92514, CVE-2026-92515,\nCVE-2026-92516, CVE-2026-92517, CVE-2026-92518, CVE-2026-92519,\nCVE-2026-92520, CVE-2026-92521, CVE-2026-92522, CVE-2026-92523,\nCVE-2026-92524, CVE-2026-92525, CVE-2026-93037, CVE-2026-93039,\nCVE-2026-93040, CVE-2026-93041, CVE-2026-93042, CVE-2026-93043,\nCVE-2026-93044, CVE-2026-93045, CVE-2026-93046, CVE-2026-93047,\nCVE-2026-93048, CVE-2026-93049, CVE-2026-93050, CVE-2026-93051,\nCVE-2026-93052, CVE-2026-93053, CVE-2026-93054, CVE-2026-93055,\nCVE-2026-93056, CVE-2026-93058, CVE-2026-93059, CVE-2026-93061,\nCVE-2026-93062, CVE-2026-93063, CVE-2026-93064, CVE-2026-93065,\nCVE-2026-93066, CVE-2026-93067, CVE-2026-93068, CVE-2026-93069,\nCVE-2026-93070, CVE-2026-93071, CVE-2026-93072, CVE-2026-93073,\nCVE-2026-93077, CVE-2026-93078, CVE-2026-93079, CVE-2026-93080,\nCVE-2026-93081, CVE-2026-93082, CVE-2026-93083, CVE-2026-93084,\nCVE-2026-93085, CVE-2026-93086, CVE-2026-93089, CVE-2026-93090,\nCVE-2026-93091, CVE-2026-93092, CVE-2026-93093, CVE-2026-93094,\nCVE-2026-93095, CVE-2026-93096, CVE-2026-93097, CVE-2026-93098,\nCVE-2026-93099, CVE-2026-93100, CVE-2026-93101, CVE-2026-93102,\nCVE-2026-93103, CVE-2026-93104, CVE-2026-93105, CVE-2026-93106,\nCVE-2026-93107, CVE-2026-93108, CVE-2026-93109, CVE-2026-93110,\nCVE-2026-93112, CVE-2026-93113, CVE-2026-93114, CVE-2026-93115,\nCVE-2026-93116, CVE-2026-93117, CVE-2026-93118, CVE-2026-93119,\nCVE-2026-93120, CVE-2026-93121, CVE-2026-93122, CVE-2026-93123,\nCVE-2026-93125, CVE-2026-93126, CVE-2026-93127, CVE-2026-93128,\nCVE-2026-93129, CVE-2026-93130, CVE-2026-93131, CVE-2026-93132,\nCVE-2026-93133, CVE-2026-93134, CVE-2026-93135, CVE-2026-93136,\nCVE-2026-93137, CVE-2026-93138, CVE-2026-93140, CVE-2026-93141,\nCVE-2026-93142, CVE-2026-93143, CVE-2026-93144, CVE-2026-93145,\nCVE-2026-93146, CVE-2026-93148, CVE-2026-93149, CVE-2026-93150,\nCVE-2026-93151, CVE-2026-93152, CVE-2026-93153, CVE-2026-93154,\nCVE-2026-93155, CVE-2026-93156, CVE-2026-93157, CVE-2026-93158,\nCVE-2026-93159, CVE-2026-93160, CVE-2026-93161, CVE-2026-93162,\nCVE-2026-93163, CVE-2026-93164, CVE-2026-93165, CVE-2026-93167,\nCVE-2026-93168, CVE-2026-93169, CVE-2026-93170, CVE-2026-93172,\nCVE-2026-93173, CVE-2026-93174, CVE-2026-93176, CVE-2026-93177,\nCVE-2026-93178, CVE-2026-93179, CVE-2026-93181, CVE-2026-93182,\nCVE-2026-93183, CVE-2026-93184, CVE-2026-93185, CVE-2026-93186,\nCVE-2026-93188, CVE-2026-93189, CVE-2026-93190, CVE-2026-93191,\nCVE-2026-93192, CVE-2026-93193, CVE-2026-93194, CVE-2026-93195,\nCVE-2026-93196, CVE-2026-93198, CVE-2026-93199, CVE-2026-93200,\nCVE-2026-93201, CVE-2026-93202, CVE-2026-93203, CVE-2026-93204,\nCVE-2026-93205, CVE-2026-93206, CVE-2026-93207, CVE-2026-93208,\nCVE-2026-93209, CVE-2026-93210, CVE-2026-93211, CVE-2026-93212,\nCVE-2026-93213, CVE-2026-93214, CVE-2026-93215, CVE-2026-93216,\nCVE-2026-93217, CVE-2026-93218, CVE-2026-93219, CVE-2026-93220,\nCVE-2026-93221, CVE-2026-93222, CVE-2026-93223, CVE-2026-93224,\nCVE-2026-93225, CVE-2026-93226, CVE-2026-93227, CVE-2026-93228,\nCVE-2026-93229, CVE-2026-93230, CVE-2026-93231, CVE-2026-93233,\nCVE-2026-93234, CVE-2026-93235, CVE-2026-93236, CVE-2026-93237,\nCVE-2026-93238, CVE-2026-93239, CVE-2026-93240, CVE-2026-93241,\nCVE-2026-93242, CVE-2026-93243, CVE-2026-93244, CVE-2026-93245,\nCVE-2026-93247, CVE-2026-93248, CVE-2026-93249, CVE-2026-93250,\nCVE-2026-93251, CVE-2026-93252, CVE-2026-93253, CVE-2026-93256,\nCVE-2026-93258, CVE-2026-93259, CVE-2026-93260, CVE-2026-93261,\nCVE-2026-93262, CVE-2026-93264, CVE-2026-93265, CVE-2026-93266,\nCVE-2026-93267, CVE-2026-93268, CVE-2026-93269, CVE-2026-93270,\nCVE-2026-93271, CVE-2026-93272, CVE-2026-93273, CVE-2026-93274,\nCVE-2026-93275, CVE-2026-93276, CVE-2026-93280, CVE-2026-93281,\nCVE-2026-93282, CVE-2026-93283, CVE-2026-93284, CVE-2026-93285,\nCVE-2026-93286, CVE-2026-93287, CVE-2026-93288, CVE-2026-93781,\nCVE-2026-93782, CVE-2026-93783, CVE-2026-93784, CVE-2026-93785,\nCVE-2026-93786, CVE-2026-93787, CVE-2026-93788, CVE-2026-93789,\nCVE-2026-93790, CVE-2026-93791, CVE-2026-93792, CVE-2026-93793,\nCVE-2026-93794, CVE-2026-93795, CVE-2026-93796, CVE-2026-93797,\nCVE-2026-93798, CVE-2026-93799, CVE-2026-93800, CVE-2026-93801,\nCVE-2026-93802, CVE-2026-93803, CVE-2026-93804, CVE-2026-93805,\nCVE-2026-93806, CVE-2026-93807, CVE-2026-93808, CVE-2026-93809,\nCVE-2026-93810, CVE-2026-93811, CVE-2026-93812, CVE-2026-93813,\nCVE-2026-93814, CVE-2026-93815, CVE-2026-93816, CVE-2026-93817,\nCVE-2026-93818, CVE-2026-93819, CVE-2026-93820, CVE-2026-93821,\nCVE-2026-93822, CVE-2026-93823, CVE-2026-93824, CVE-2026-93825,\nCVE-2026-93826, CVE-2026-93827, CVE-2026-93828, CVE-2026-93829,\nCVE-2026-93830, CVE-2026-97407, CVE-2026-97408, CVE-2026-97409,\nCVE-2026-97410, CVE-2026-97411, CVE-2026-97412, CVE-2026-97413,\nCVE-2026-97414, CVE-2026-97415, CVE-2026-97416, CVE-2026-97417,\nCVE-2026-97418, CVE-2026-97419, CVE-2026-97420, CVE-2026-97421,\nCVE-2026-97422, CVE-2026-97423, CVE-2026-97424, CVE-2026-97425,\nCVE-2026-97426, CVE-2026-97427, CVE-2026-97428, CVE-2026-97429,\nCVE-2026-97430, CVE-2026-97431, CVE-2026-97432, CVE-2026-97433,\nCVE-2026-97434, CVE-2026-97435, CVE-2026-97436, CVE-2026-97437,\nCVE-2026-97438, CVE-2026-97439, CVE-2026-97440, CVE-2026-97441,\nCVE-2026-97442, CVE-2026-97443, CVE-2026-97444, CVE-2026-97445,\nCVE-2026-97446, CVE-2026-97447, CVE-2026-97448, CVE-2026-97449,\nCVE-2026-97450, CVE-2026-97451, CVE-2026-97452, CVE-2026-97453,\nCVE-2026-97454, CVE-2026-97455, CVE-2026-97456, CVE-2026-97472,\nCVE-2026-97473, CVE-2026-97474, CVE-2026-97475, CVE-2026-97476,\nCVE-2026-97477, CVE-2026-97478, CVE-2026-97479, CVE-2026-97480,\nCVE-2026-97481, CVE-2026-97482, CVE-2026-97483, CVE-2026-97484,\nCVE-2026-97485, CVE-2026-97486, CVE-2026-97487, CVE-2026-97488,\nCVE-2026-97489, CVE-2026-97490, CVE-2026-97491, CVE-2026-97492,\nCVE-2026-97493, CVE-2026-97494, CVE-2026-97495, CVE-2026-97496,\nCVE-2026-97497, CVE-2026-97498, CVE-2026-97499, CVE-2026-97500,\nCVE-2026-97501, CVE-2026-97502, CVE-2026-97503, CVE-2026-97505,\nCVE-2026-97506, CVE-2026-97507, CVE-2026-97508, CVE-2026-97509,\nCVE-2026-97510, CVE-2026-97511, CVE-2026-97512, CVE-2026-97513,\nCVE-2026-97514, CVE-2026-97515, CVE-2026-97516, CVE-2026-97517,\nCVE-2026-97518, CVE-2026-97519, CVE-2026-97520, CVE-2026-97521,\nCVE-2026-97522, CVE-2026-97523, CVE-2026-97524, CVE-2026-97525,\nCVE-2026-97526, CVE-2026-97527, CVE-2026-97528, CVE-2026-97529,\nCVE-2026-97530, CVE-2026-97531, CVE-2026-97532, CVE-2026-97533,\nCVE-2026-97534, CVE-2026-97535, CVE-2026-97536, CVE-2026-97537,\nCVE-2026-97538, CVE-2026-97539, CVE-2026-97540, CVE-2026-97541,\nCVE-2026-97542, CVE-2026-97543, CVE-2026-97544, CVE-2026-97545,\nCVE-2026-97546, CVE-2026-97547, CVE-2026-97548, CVE-2026-97549,\nCVE-2026-97550, CVE-2026-97551, CVE-2026-97552, CVE-2026-97553,\nCVE-2026-97554, CVE-2026-97555, CVE-2026-97556, CVE-2026-97557,\nCVE-2026-97558, CVE-2026-97559, CVE-2026-97560, CVE-2026-97561,\nCVE-2026-97562, CVE-2026-97563, CVE-2026-97564, CVE-2026-97565,\nCVE-2026-97566, CVE-2026-97567, CVE-2026-97568, CVE-2026-97571,\nCVE-2026-97572, CVE-2026-97573, CVE-2026-97574, CVE-2026-97575,\nCVE-2026-97576, CVE-2026-97577, CVE-2026-97578, CVE-2026-97579,\nCVE-2026-97580, CVE-2026-97581, CVE-2026-97582, CVE-2026-97583,\nCVE-2026-97584, CVE-2026-97585, CVE-2026-97586, CVE-2026-97587,\nCVE-2026-97588, CVE-2026-97589, CVE-2026-97590, CVE-2026-97591,\nCVE-2026-97592, CVE-2026-97593, CVE-2026-97594, CVE-2026-97595,\nCVE-2026-97596, CVE-2026-97597, CVE-2026-97598, CVE-2026-97599,\nCVE-2026-97600, CVE-2026-97601, CVE-2026-97602, CVE-2026-97603,\nCVE-2026-97604, CVE-2026-97605, CVE-2026-97606, CVE-2026-97607,\nCVE-2026-97608, CVE-2026-97609, CVE-2026-97610, CVE-2026-97611,\nCVE-2026-97612, CVE-2026-97613, CVE-2026-97614, CVE-2026-97615,\nCVE-2026-97616, CVE-2026-97617, CVE-2026-97618, CVE-2026-97619,\nCVE-2026-97620, CVE-2026-97621, CVE-2026-97899, CVE-2026-97900,\nCVE-2026-97901, CVE-2026-97902, CVE-2026-97903, CVE-2026-97904,\nCVE-2026-97905, CVE-2026-97906, CVE-2026-97907, CVE-2026-97908,\nCVE-2026-97909, CVE-2026-97910, CVE-2026-97912, CVE-2026-97913,\nCVE-2026-97914, CVE-2026-97915, CVE-2026-97916, CVE-2026-97917,\nCVE-2026-97918, CVE-2026-97919, CVE-2026-97920, CVE-2026-97921,\nCVE-2026-97922, CVE-2026-97923, CVE-2026-97924, CVE-2026-97925,\nCVE-2026-97926, CVE-2026-97927, CVE-2026-97928, CVE-2026-97929,\nCVE-2026-97930, CVE-2026-97931, CVE-2026-97932, CVE-2026-97933,\nCVE-2026-97934, CVE-2026-97935, CVE-2026-97936, CVE-2026-97938,\nCVE-2026-97939, CVE-2026-97940, CVE-2026-97942, CVE-2026-97943,\nCVE-2026-97944, CVE-2026-97945, CVE-2026-97946, CVE-2026-97947,\nCVE-2026-97948, CVE-2026-97950, CVE-2026-97951, CVE-2026-97953,\nCVE-2026-97954, CVE-2026-97955, CVE-2026-97956, CVE-2026-97957,\nCVE-2026-97958, CVE-2026-97959, CVE-2026-97960, CVE-2026-97961,\nCVE-2026-97962, CVE-2026-97963, CVE-2026-97964, CVE-2026-97965,\nCVE-2026-97966, CVE-2026-97967, CVE-2026-97968, CVE-2026-97969,\nCVE-2026-97970, CVE-2026-97971, CVE-2026-97972, CVE-2026-97973,\nCVE-2026-97974, CVE-2026-97975, CVE-2026-97976, CVE-2026-97977,\nCVE-2026-97978, CVE-2026-97979, CVE-2026-97981, CVE-2026-97982,\nCVE-2026-97983, CVE-2026-97984, CVE-2026-97985, CVE-2026-97986,\nCVE-2026-97987, CVE-2026-97988, CVE-2026-97989, CVE-2026-97990,\nCVE-2026-97991, CVE-2026-97992, CVE-2026-97993, CVE-2026-97994,\nCVE-2026-97995, CVE-2026-97996, CVE-2026-97997, CVE-2026-97998,\nCVE-2026-98000, CVE-2026-98001, CVE-2026-98002, CVE-2026-98003,\nCVE-2026-98004, CVE-2026-98005, CVE-2026-98006, CVE-2026-98007,\nCVE-2026-98008, CVE-2026-98009, CVE-2026-98010, CVE-2026-98011,\nCVE-2026-98012, CVE-2026-98013, CVE-2026-98014, CVE-2026-98015,\nCVE-2026-98016, CVE-2026-98017, CVE-2026-98018, CVE-2026-98019,\nCVE-2026-98020, CVE-2026-98021, CVE-2026-98022, CVE-2026-98023,\nCVE-2026-98024, CVE-2026-98025, CVE-2026-98026, CVE-2026-98027,\nCVE-2026-98028, CVE-2026-98029, CVE-2026-98030, CVE-2026-98031,\nCVE-2026-98032, CVE-2026-98033, CVE-2026-98034, CVE-2026-98037,\nCVE-2026-98039, CVE-2026-98041, CVE-2026-98043, CVE-2026-98044,\nCVE-2026-98045, CVE-2026-98046, CVE-2026-98047, CVE-2026-98048,\nCVE-2026-98049, CVE-2026-98050, CVE-2026-98051, CVE-2026-98052,\nCVE-2026-98053, CVE-2026-98054, CVE-2026-98055, CVE-2026-98056,\nCVE-2026-98057, CVE-2026-98058, CVE-2026-98059, CVE-2026-98060,\nCVE-2026-98061, CVE-2026-98062, CVE-2026-98063, CVE-2026-98064,\nCVE-2026-98065, CVE-2026-98066, CVE-2026-98067, CVE-2026-98068,\nCVE-2026-98069, CVE-2026-98070, CVE-2026-98071, CVE-2026-98072,\nCVE-2026-98073, CVE-2026-98074, CVE-2026-98075, CVE-2026-98076,\nCVE-2026-98077, CVE-2026-98078, CVE-2026-98079, CVE-2026-98080,\nCVE-2026-98081, CVE-2026-98082, CVE-2026-98083, CVE-2026-98084,\nCVE-2026-98085, CVE-2026-98086, CVE-2026-98087, CVE-2026-98088,\nCVE-2026-98089, CVE-2026-98090, CVE-2026-98091, CVE-2026-98092,\nCVE-2026-98093, CVE-2026-98094, CVE-2026-98095, CVE-2026-98096,\nCVE-2026-98097, CVE-2026-98098, CVE-2026-98099, CVE-2026-98101,\nCVE-2026-98102, CVE-2026-98103, CVE-2026-98104, CVE-2026-98105,\nCVE-2026-98106, CVE-2026-98107, CVE-2026-98108, CVE-2026-98109,\nCVE-2026-98110, CVE-2026-98111, CVE-2026-98112, CVE-2026-98113,\nCVE-2026-98114, CVE-2026-98115, CVE-2026-98116, CVE-2026-98117,\nCVE-2026-98118, CVE-2026-98119, CVE-2026-98120, CVE-2026-98121,\nCVE-2026-98122, CVE-2026-98123, CVE-2026-98124, CVE-2026-98125,\nCVE-2026-98126, CVE-2026-98127, CVE-2026-98128, CVE-2026-98129,\nCVE-2026-98130, CVE-2026-98131, CVE-2026-98134, CVE-2026-98142,\nCVE-2026-98143, CVE-2026-98146, CVE-2026-98147, CVE-2026-98148,\nCVE-2026-98149, CVE-2026-98150, CVE-2026-98151, CVE-2026-98152,\nCVE-2026-98153, CVE-2026-98154, CVE-2026-98155, CVE-2026-98156,\nCVE-2026-98157, CVE-2026-98158, CVE-2026-98159, CVE-2026-98160,\nCVE-2026-98161, CVE-2026-98162, CVE-2026-98163, CVE-2026-98164,\nCVE-2026-98166, CVE-2026-98167, CVE-2026-98168, CVE-2026-98169,\nCVE-2026-98170, CVE-2026-98171, CVE-2026-98172, CVE-2026-98173,\nCVE-2026-98174, CVE-2026-98175, CVE-2026-98176, CVE-2026-98177,\nCVE-2026-98179, CVE-2026-98180, CVE-2026-98181, CVE-2026-98182,\nCVE-2026-98184, CVE-2026-98185, CVE-2026-98186, CVE-2026-98187,\nCVE-2026-98188, CVE-2026-98189, CVE-2026-98190, CVE-2026-98191,\nCVE-2026-98192, CVE-2026-98193, CVE-2026-98194, CVE-2026-98195,\nCVE-2026-98196, CVE-2026-98197, CVE-2026-98198, CVE-2026-98199,\nCVE-2026-98200, CVE-2026-98201, CVE-2026-98202, CVE-2026-98203,\nCVE-2026-98204, CVE-2026-98205, CVE-2026-98206, CVE-2026-98207,\nCVE-2026-98208, CVE-2026-98209, CVE-2026-98210, CVE-2026-98211,\nCVE-2026-98212, CVE-2026-98213, CVE-2026-98214, CVE-2026-98215,\nCVE-2026-98216, CVE-2026-98217, CVE-2026-98218, CVE-2026-98221,\nCVE-2026-98222, CVE-2026-98223, CVE-2026-98224, CVE-2026-98226,\nCVE-2026-98227, CVE-2026-98228, CVE-2026-98229, CVE-2026-98230,\nCVE-2026-98231, CVE-2026-98232, CVE-2026-98233, CVE-2026-98234,\nCVE-2026-98235, CVE-2026-98236, CVE-2026-98237, CVE-2026-98238,\nCVE-2026-98239, CVE-2026-98240, CVE-2026-98241, CVE-2026-98242,\nCVE-2026-98244, CVE-2026-98245, CVE-2026-98246, CVE-2026-98247,\nCVE-2026-98248, CVE-2026-98249, CVE-2026-98251, CVE-2026-98252,\nCVE-2026-98253, CVE-2026-98254, CVE-2026-98255, CVE-2026-98256,\nCVE-2026-98257, CVE-2026-98258, CVE-2026-98259, CVE-2026-98260,\nCVE-2026-98261, CVE-2026-98262, CVE-2026-98263, CVE-2026-98264,\nCVE-2026-98265, CVE-2026-98266, CVE-2026-98267, CVE-2026-98268,\nCVE-2026-98269, CVE-2026-98270, CVE-2026-98271, CVE-2026-98272,\nCVE-2026-98273, CVE-2026-98274, CVE-2026-98275, CVE-2026-98276,\nCVE-2026-98277, CVE-2026-98278, CVE-2026-98279, CVE-2026-98280,\nCVE-2026-98281, CVE-2026-98282, CVE-2026-98283, CVE-2026-98284,\nCVE-2026-98285, CVE-2026-98286, CVE-2026-98287, CVE-2026-98288,\nCVE-2026-98289, CVE-2026-98290, CVE-2026-98291, CVE-2026-98292,\nCVE-2026-98293, CVE-2026-98294, CVE-2026-98295, CVE-2026-98296,\nCVE-2026-98297, CVE-2026-98298, CVE-2026-98299, CVE-2026-98300,\nCVE-2026-98301, CVE-2026-98302, CVE-2026-98303, CVE-2026-98304,\nCVE-2026-98306, CVE-2026-98307, CVE-2026-98308, CVE-2026-98309,\nCVE-2026-98311, CVE-2026-98312, CVE-2026-98314, CVE-2026-98317,\nCVE-2026-98318, CVE-2026-98319, CVE-2026-98320, CVE-2026-98321,\nCVE-2026-98322, CVE-2026-98323, CVE-2026-98324, CVE-2026-98325,\nCVE-2026-98326, CVE-2026-98327, CVE-2026-98328, CVE-2026-98329,\nCVE-2026-98330, CVE-2026-98331, CVE-2026-98332, CVE-2026-98333,\nCVE-2026-98334, CVE-2026-98335, CVE-2026-98336, CVE-2026-98337,\nCVE-2026-98338, CVE-2026-98339, CVE-2026-98340, CVE-2026-98341,\nCVE-2026-98342, CVE-2026-98343, CVE-2026-98344, CVE-2026-98345,\nCVE-2026-98346, CVE-2026-98347, CVE-2026-98348, CVE-2026-98349,\nCVE-2026-98350, CVE-2026-98351, CVE-2026-98352, CVE-2026-98354,\nCVE-2026-98355, CVE-2026-98356, CVE-2026-98357, CVE-2026-98358,\nCVE-2026-98359, CVE-2026-98360, CVE-2026-98361, CVE-2026-98362,\nCVE-2026-98363, CVE-2026-98364, CVE-2026-98365, CVE-2026-98366,\nCVE-2026-98367, CVE-2026-98368, CVE-2026-98369, CVE-2026-98370,\nCVE-2026-98371, CVE-2026-98372, CVE-2026-98373, CVE-2026-98374,\nCVE-2026-98377, CVE-2026-98378, CVE-2026-98379, CVE-2026-98380,\nCVE-2026-98381, CVE-2026-98382, CVE-2026-98383, CVE-2026-98384,\nCVE-2026-98386, CVE-2026-98387, CVE-2026-98388, CVE-2026-98389,\nCVE-2026-98390, CVE-2026-98391, CVE-2026-98392, CVE-2026-98393,\nCVE-2026-98394, CVE-2026-98398, CVE-2026-98399, CVE-2026-98400,\nCVE-2026-98401, CVE-2026-98402, CVE-2026-98403, CVE-2026-98404,\nCVE-2026-98406, CVE-2026-98407, CVE-2026-98408, CVE-2026-98409,\nCVE-2026-98410, CVE-2026-98411, CVE-2026-98412, CVE-2026-98413,\nCVE-2026-98414, CVE-2026-98415, CVE-2026-98416, CVE-2026-98417,\nCVE-2026-98419, CVE-2026-98421, CVE-2026-98422, CVE-2026-98423,\nCVE-2026-98424, CVE-2026-98425, CVE-2026-98426, CVE-2026-98427,\nCVE-2026-98428, CVE-2026-98429, CVE-2026-98430, CVE-2026-98431,\nCVE-2026-98433, CVE-2026-98434, CVE-2026-98435, CVE-2026-98436,\nCVE-2026-98437, CVE-2026-98439, CVE-2026-98440, CVE-2026-98441,\nCVE-2026-98442, CVE-2026-98443, CVE-2026-98444, CVE-2026-98445,\nCVE-2026-98446, CVE-2026-98447, CVE-2026-98448, CVE-2026-98449,\nCVE-2026-98450, CVE-2026-98451, CVE-2026-98452, CVE-2026-98453,\nCVE-2026-98454, CVE-2026-98455, CVE-2026-98456, CVE-2026-98457,\nCVE-2026-98458, CVE-2026-98459, CVE-2026-98460, CVE-2026-98461,\nCVE-2026-98462, CVE-2026-98463, CVE-2026-98464, CVE-2026-98465,\nCVE-2026-98466, CVE-2026-98467, CVE-2026-98468, CVE-2026-98469,\nCVE-2026-98470, CVE-2026-98471, CVE-2026-98472, CVE-2026-98473,\nCVE-2026-98474, CVE-2026-98475, CVE-2026-98476, CVE-2026-98477,\nCVE-2026-98478, CVE-2026-98479, CVE-2026-98480, CVE-2026-98481,\nCVE-2026-98482, CVE-2026-98483, CVE-2026-98484, CVE-2026-98485,\nCVE-2026-98486, CVE-2026-98487, CVE-2026-98488, CVE-2026-98489,\nCVE-2026-98490, CVE-2026-98491, CVE-2026-98492, CVE-2026-98493,\nCVE-2026-98494, CVE-2026-98495, CVE-2026-98496, CVE-2026-98497,\nCVE-2026-98498, CVE-2026-98499, CVE-2026-98501, CVE-2026-98502,\nCVE-2026-98503, CVE-2026-98504, CVE-2026-98505, CVE-2026-98506,\nCVE-2026-98507, CVE-2026-98508, CVE-2026-98509, CVE-2026-98510,\nCVE-2026-98511, CVE-2026-98512, CVE-2026-98513, CVE-2026-98514,\nCVE-2026-98515, CVE-2026-98516, CVE-2026-98517, CVE-2026-98518,\nCVE-2026-98519, CVE-2026-98521, CVE-2026-98522, CVE-2026-98523,\nCVE-2026-98524, CVE-2026-98525, CVE-2026-98526, CVE-2026-98527,\nCVE-2026-98528, CVE-2026-98529, CVE-2026-98530, CVE-2026-98531,\nCVE-2026-98532, CVE-2026-98533, CVE-2026-98534, CVE-2026-98535,\nCVE-2026-98536, CVE-2026-98537, CVE-2026-98538, CVE-2026-98539,\nCVE-2026-98541, CVE-2026-98542, CVE-2026-98543, CVE-2026-98544,\nCVE-2026-98545, CVE-2026-98546, CVE-2026-98547, CVE-2026-98548,\nCVE-2026-98549, CVE-2026-98550, CVE-2026-98551, CVE-2026-98552,\nCVE-2026-98553, CVE-2026-98554, CVE-2026-98555, CVE-2026-98556,\nCVE-2026-98558, CVE-2026-98559, CVE-2026-98560, CVE-2026-98561,\nCVE-2026-98562, CVE-2026-98563, CVE-2026-98564, CVE-2026-98565,\nCVE-2026-98566, CVE-2026-98567, CVE-2026-98568, CVE-2026-98569,\nCVE-2026-98570, CVE-2026-98571, CVE-2026-98572, CVE-2026-98573,\nCVE-2026-98574, CVE-2026-98575, CVE-2026-98576, CVE-2026-98577,\nCVE-2026-98578, CVE-2026-98579, CVE-2026-98580, CVE-2026-98581,\nCVE-2026-98582, CVE-2026-98583, CVE-2026-98584, CVE-2026-98585,\nCVE-2026-98586, CVE-2026-98588, CVE-2026-98589, CVE-2026-98590,\nCVE-2026-98591, CVE-2026-98592, CVE-2026-98593, CVE-2026-98594,\nCVE-2026-98595, CVE-2026-98596, CVE-2026-98597, CVE-2026-98598,\nCVE-2026-98599, CVE-2026-98601, CVE-2026-98602, CVE-2026-98603,\nCVE-2026-98604, CVE-2026-98605, CVE-2026-98606, CVE-2026-98607,\nCVE-2026-98608, CVE-2026-98609, CVE-2026-98610, CVE-2026-98611,\nCVE-2026-98612, CVE-2026-98613, CVE-2026-98614, CVE-2026-98615,\nCVE-2026-98616, CVE-2026-98617, CVE-2026-98618, CVE-2026-98620,\nCVE-2026-98621, CVE-2026-98622, CVE-2026-98623, CVE-2026-98624,\nCVE-2026-98625, CVE-2026-98626, CVE-2026-98628, CVE-2026-98629,\nCVE-2026-98630, CVE-2026-98631, CVE-2026-98632, CVE-2026-98633,\nCVE-2026-98634, CVE-2026-98635, CVE-2026-98636, CVE-2026-98637,\nCVE-2026-98638, CVE-2026-98639, CVE-2026-98640, CVE-2026-98641,\nCVE-2026-98642, CVE-2026-98643, CVE-2026-98644, CVE-2026-98646,\nCVE-2026-98647, CVE-2026-98648, CVE-2026-98649, CVE-2026-98650,\nCVE-2026-98651, CVE-2026-98652, CVE-2026-98653, CVE-2026-98867,\nCVE-2026-98868, CVE-2026-98871, CVE-2026-98872, CVE-2026-98873,\nCVE-2026-98874, CVE-2026-98875, CVE-2026-98876, CVE-2026-98877,\nCVE-2026-98878, CVE-2026-98879, CVE-2026-98880, CVE-2026-98881,\nCVE-2026-98882, CVE-2026-98883, CVE-2026-98884, CVE-2026-98885,\nCVE-2026-98886, CVE-2026-98887, CVE-2026-98888, CVE-2026-98889,\nCVE-2026-98891, CVE-2026-98892, CVE-2026-98893, CVE-2026-98894,\nCVE-2026-98895, CVE-2026-98896, CVE-2026-98897, CVE-2026-98898,\nCVE-2026-98899, CVE-2026-98900, CVE-2026-98901, CVE-2026-98902,\nCVE-2026-98903, CVE-2026-98904, CVE-2026-98905, CVE-2026-98906,\nCVE-2026-98907, CVE-2026-98908, CVE-2026-98909, CVE-2026-98910,\nCVE-2026-98911, CVE-2026-98912, CVE-2026-98913, CVE-2026-98914,\nCVE-2026-98915, CVE-2026-98916, CVE-2026-98917, CVE-2026-98918,\nCVE-2026-98919, CVE-2026-98921, CVE-2026-98923, CVE-2026-98924,\nCVE-2026-98925, CVE-2026-98926, CVE-2026-98927, CVE-2026-98928,\nCVE-2026-98929, CVE-2026-98930)\n","status":"published","published":"2026-11-03T11:03:44Z","modified":"2026-11-09T12:53:33.925621133Z","updated_at":"2026-11-09T13:25:32.592646Z"},{"id":"USN-8960-1","title":"linux-oem-7.0 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - USB Gadget drivers;\n  - Memory management;\n  - Multiple devices driver;\n  - ARM64 architecture;\n  - EROFS file system;\n  - Networking core;\n  - eXpress Data Path;\n  - ARM32 architecture;\n  - M68K architecture;\n  - MIPS architecture;\n  - OpenRISC architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - Intel NPU Driver;\n  - Speakup Console Speech Driver;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Auxiliary display drivers;\n  - Drivers core;\n  - Micron PCIe SSD driver;\n  - Null block device driver;\n  - Ublk userspace block driver;\n  - Compressed RAM block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - AMD CDX bus driver;\n  - Hardware random number generator core;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - CPU frequency scaling framework;\n  - CPU idle management framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - DAX dirext access to differentiated memory framework;\n  - DIBS (Direct Internal Buffer Sharing) drivers;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - FireWire subsystem;\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - Google firmware drivers;\n  - Qualcomm firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - HSI subsystem;\n  - Microsoft Hyper-V drivers;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - On-Chip Interconnect management framework;\n  - IOMMU subsystem;\n  - Industry Pack bus drivers;\n  - IRQ chip drivers;\n  - Mailbox framework;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Analog Devices digital potentiometer driver;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - Amazon Nitro Secure Module driver;\n  - SGI GRU driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Network drivers;\n  - Ethernet bonding driver;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - Operating Performance Points (OPP) driver;\n  - PA-RISC drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - Mellanox platform drivers;\n  - Microsoft Surface platform drivers;\n  - x86 platform drivers;\n  - MediaTek PM domains;\n  - Power sequencing drivers;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - MPAM driver;\n  - RPMSG subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - Samsung SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - USB DSL drivers;\n  - Cypress C67X00 USB driver;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - Intel La Jolla Cove Adapter USB driver;\n  - Intel USBIO USB I/O expander driver;\n  - USB Serial drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - ACRN Hypervisor Service Module driver;\n  - Virtio drivers;\n  - W1 Dallas's 1-wire bus driver;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - 9P distributed file system;\n  - File systems infrastructure;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - debug file system;\n  - eCrypt file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Overlay file system;\n  - SMB network file system;\n  - SquashFS file system;\n  - Tracing file system;\n  - UBI file system;\n  - UDF file system;\n  - XFS file system;\n  - BPF subsystem;\n  - Tracing infrastructure;\n  - Kernel futex primitives;\n  - Memory Management;\n  - VLANs driver;\n  - IPv4 networking;\n  - io_uring subsystem;\n  - KProbes tracing;\n  - KVM subsystem;\n  - Live Update Orchestrator (LUO);\n  - Netfilter;\n  - Perf events;\n  - Scheduler infrastructure;\n  - Signal handling mechanism;\n  - Networking subsytem;\n  - Slab allocator;\n  - Sun RPC protocol;\n  - Vector I/O iterator library;\n  - Virtio network driver;\n  - Network traffic control;\n  - IPv6 networking;\n  - Bluetooth subsystem;\n  - IEEE 802.15.4 subsystem;\n  - IP tunnels definitions;\n  - MAC80211 subsystem;\n  - NFC subsystem;\n  - SCTP protocol;\n  - Network sockets;\n  - TCP network protocol;\n  - User-space API (UAPI);\n  - Kernel init infrastructure;\n  - Audit subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - DMA mapping infrastructure;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - IRQ subsystem;\n  - KCOV code coverage framework;\n  - Locking primitives;\n  - Kernel module support;\n  - Namespaces infrastructure;\n  - Kernel command line parsing driver;\n  - PID allocator;\n  - printk logging mechanism;\n  - System reboot mechanism;\n  - Timer subsystem;\n  - Workqueue subsystem;\n  - Kernel build system;\n  - Heterogeneous memory management;\n  - UCS-2 string library;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Devlink API;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - L2TP protocol;\n  - Logical Link layer;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - Netlink;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - PSP security protocol;\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - SMC sockets;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - XFRM subsystem;\n  - AppArmor security module;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Linux Security Modules (LSM) Framework;\n  - Key management;\n  - Landlock security;\n  - SELinux security module;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - Generic sound devices;\n  - HD-audio driver;\n  - ESS ES18xx ALSA driver;\n  - ICE1712/ICE1724 (Envy24) ALSA driver;\n  - Digigram PCXHR ALSA driver;\n  - AMD SoC Alsa drivers;\n  - Cirrus Logic audio codecs;\n  - QCOM ASoC drivers;\n  - Realtek audio codecs;\n  - Texas InstrumentS Audio (ASoC/HDA) drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - Amlogic Meson SoC drivers;\n  - Rockchip ASoC drivers;\n  - SoundWire (SDCA) ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Spreadtrum ASoC drivers;\n  - STI ASoC drivers;\n  - Xilinx ASoC drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n(CVE-2026-100070, CVE-2026-100071, CVE-2026-100072, CVE-2026-100073,\nCVE-2026-100074, CVE-2026-100075, CVE-2026-100076, CVE-2026-100077,\nCVE-2026-100078, CVE-2026-100079, CVE-2026-68451, CVE-2026-68452,\nCVE-2026-68453, CVE-2026-74440, CVE-2026-74441, CVE-2026-74442,\nCVE-2026-74443, CVE-2026-74444, CVE-2026-74445, CVE-2026-74446,\nCVE-2026-74447, CVE-2026-74448, CVE-2026-74449, CVE-2026-74450,\nCVE-2026-74451, CVE-2026-74452, CVE-2026-74453, CVE-2026-74454,\nCVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458,\nCVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74462,\nCVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74466,\nCVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74470,\nCVE-2026-74471, CVE-2026-74472, CVE-2026-74473, CVE-2026-74474,\nCVE-2026-74475, CVE-2026-74476, CVE-2026-74477, CVE-2026-74478,\nCVE-2026-74479, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482,\nCVE-2026-74483, CVE-2026-74484, CVE-2026-74485, CVE-2026-74486,\nCVE-2026-74487, CVE-2026-74488, CVE-2026-74490, CVE-2026-74491,\nCVE-2026-74492, CVE-2026-74493, CVE-2026-74494, CVE-2026-74495,\nCVE-2026-74496, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499,\nCVE-2026-74500, CVE-2026-74501, CVE-2026-74502, CVE-2026-74503,\nCVE-2026-74504, CVE-2026-74505, CVE-2026-74506, CVE-2026-74507,\nCVE-2026-74508, CVE-2026-74509, CVE-2026-74510, CVE-2026-74512,\nCVE-2026-74513, CVE-2026-74514, CVE-2026-74515, CVE-2026-74516,\nCVE-2026-74517, CVE-2026-74518, CVE-2026-74519, CVE-2026-74520,\nCVE-2026-74521, CVE-2026-74522, CVE-2026-74523, CVE-2026-74524,\nCVE-2026-74525, CVE-2026-74526, CVE-2026-74528, CVE-2026-74529,\nCVE-2026-74530, CVE-2026-74531, CVE-2026-74532, CVE-2026-74533,\nCVE-2026-74534, CVE-2026-74535, CVE-2026-74536, CVE-2026-74537,\nCVE-2026-74538, CVE-2026-74539, CVE-2026-74540, CVE-2026-74541,\nCVE-2026-74542, CVE-2026-74543, CVE-2026-74544, CVE-2026-74545,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74550, CVE-2026-74551, CVE-2026-74552, CVE-2026-74553,\nCVE-2026-74554, CVE-2026-74555, CVE-2026-74556, CVE-2026-74557,\nCVE-2026-74558, CVE-2026-74559, CVE-2026-74560, CVE-2026-74561,\nCVE-2026-74562, CVE-2026-74563, CVE-2026-74564, CVE-2026-74565,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74571,\nCVE-2026-74572, CVE-2026-74573, CVE-2026-74574, CVE-2026-74576,\nCVE-2026-74577, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581,\nCVE-2026-74582, CVE-2026-74583, CVE-2026-74585, CVE-2026-74586,\nCVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74590,\nCVE-2026-74591, CVE-2026-74592, CVE-2026-74593, CVE-2026-74594,\nCVE-2026-74595, CVE-2026-74596, CVE-2026-74597, CVE-2026-74598,\nCVE-2026-74599, CVE-2026-74600, CVE-2026-74601, CVE-2026-74602,\nCVE-2026-74603, CVE-2026-74604, CVE-2026-74605, CVE-2026-74606,\nCVE-2026-74607, CVE-2026-74608, CVE-2026-74609, CVE-2026-74610,\nCVE-2026-74611, CVE-2026-74612, CVE-2026-74613, CVE-2026-74614,\nCVE-2026-74615, CVE-2026-74616, CVE-2026-74617, CVE-2026-74618,\nCVE-2026-74619, CVE-2026-74620, CVE-2026-74621, CVE-2026-74622,\nCVE-2026-74623, CVE-2026-74624, CVE-2026-74625, CVE-2026-74626,\nCVE-2026-74627, CVE-2026-74628, CVE-2026-74629, CVE-2026-74630,\nCVE-2026-74631, CVE-2026-74632, CVE-2026-74633, CVE-2026-74634,\nCVE-2026-74635, CVE-2026-74636, CVE-2026-74637, CVE-2026-74638,\nCVE-2026-74639, CVE-2026-74640, CVE-2026-74641, CVE-2026-74643,\nCVE-2026-74644, CVE-2026-74645, CVE-2026-74646, CVE-2026-74647,\nCVE-2026-74648, CVE-2026-74649, CVE-2026-74650, CVE-2026-74651,\nCVE-2026-74652, CVE-2026-74653, CVE-2026-74654, CVE-2026-74655,\nCVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659,\nCVE-2026-74660, CVE-2026-74661, CVE-2026-74662, CVE-2026-74663,\nCVE-2026-74664, CVE-2026-74665, CVE-2026-74666, CVE-2026-74667,\nCVE-2026-74668, CVE-2026-74669, CVE-2026-74670, CVE-2026-74671,\nCVE-2026-74672, CVE-2026-74673, CVE-2026-74674, CVE-2026-74675,\nCVE-2026-74676, CVE-2026-74677, CVE-2026-74678, CVE-2026-74679,\nCVE-2026-74680, CVE-2026-74681, CVE-2026-74682, CVE-2026-74683,\nCVE-2026-74684, CVE-2026-74685, CVE-2026-74686, CVE-2026-74687,\nCVE-2026-74688, CVE-2026-74689, CVE-2026-74690, CVE-2026-74691,\nCVE-2026-74692, CVE-2026-74693, CVE-2026-74694, CVE-2026-74695,\nCVE-2026-74696, CVE-2026-74697, CVE-2026-74698, CVE-2026-74699,\nCVE-2026-74700, CVE-2026-74701, CVE-2026-74702, CVE-2026-74703,\nCVE-2026-74704, CVE-2026-74705, CVE-2026-74706, CVE-2026-74707,\nCVE-2026-74708, CVE-2026-74709, CVE-2026-74710, CVE-2026-74711,\nCVE-2026-74712, CVE-2026-74713, CVE-2026-74714, CVE-2026-74715,\nCVE-2026-74716, CVE-2026-74717, CVE-2026-74718, CVE-2026-74719,\nCVE-2026-74720, CVE-2026-74721, CVE-2026-74722, CVE-2026-74723,\nCVE-2026-74724, CVE-2026-74725, CVE-2026-74726, CVE-2026-74727,\nCVE-2026-74728, CVE-2026-74729, CVE-2026-74730, CVE-2026-74733,\nCVE-2026-74734, CVE-2026-74735, CVE-2026-74736, CVE-2026-74737,\nCVE-2026-74738, CVE-2026-74739, CVE-2026-74740, CVE-2026-74741,\nCVE-2026-74742, CVE-2026-74743, CVE-2026-74744, CVE-2026-74745,\nCVE-2026-74746, CVE-2026-74747, CVE-2026-74748, CVE-2026-74750,\nCVE-2026-74752, CVE-2026-74753, CVE-2026-74754, CVE-2026-80519,\nCVE-2026-80520, CVE-2026-80521, CVE-2026-80522, CVE-2026-80523,\nCVE-2026-80524, CVE-2026-80525, CVE-2026-80526, CVE-2026-80527,\nCVE-2026-80528, CVE-2026-80529, CVE-2026-80530, CVE-2026-80531,\nCVE-2026-80532, CVE-2026-80533, CVE-2026-80534, CVE-2026-80535,\nCVE-2026-80536, CVE-2026-80537, CVE-2026-80538, CVE-2026-80539,\nCVE-2026-80540, CVE-2026-80541, CVE-2026-80542, CVE-2026-80547,\nCVE-2026-80548, CVE-2026-80549, CVE-2026-80550, CVE-2026-80551,\nCVE-2026-80552, CVE-2026-80553, CVE-2026-80554, CVE-2026-80555,\nCVE-2026-80556, CVE-2026-80557, CVE-2026-80558, CVE-2026-80559,\nCVE-2026-80560, CVE-2026-80561, CVE-2026-80562, CVE-2026-80563,\nCVE-2026-80564, CVE-2026-80565, CVE-2026-80566, CVE-2026-80567,\nCVE-2026-80568, CVE-2026-80569, CVE-2026-80570, CVE-2026-80571,\nCVE-2026-80572, CVE-2026-80573, CVE-2026-80574, CVE-2026-80575,\nCVE-2026-80576, CVE-2026-80577, CVE-2026-80578, CVE-2026-80579,\nCVE-2026-80580, CVE-2026-80581, CVE-2026-80582, CVE-2026-80583,\nCVE-2026-80584, CVE-2026-80585, CVE-2026-80586, CVE-2026-80587,\nCVE-2026-80588, CVE-2026-80589, CVE-2026-80590, CVE-2026-80678,\nCVE-2026-80679, CVE-2026-80680, CVE-2026-80681, CVE-2026-80683,\nCVE-2026-80684, CVE-2026-80685, CVE-2026-80686, CVE-2026-80687,\nCVE-2026-80688, CVE-2026-80689, CVE-2026-80690, CVE-2026-80691,\nCVE-2026-80692, CVE-2026-80693, CVE-2026-80694, CVE-2026-80695,\nCVE-2026-80696, CVE-2026-80697, CVE-2026-80698, CVE-2026-80699,\nCVE-2026-80700, CVE-2026-80701, CVE-2026-80702, CVE-2026-80703,\nCVE-2026-80704, CVE-2026-80705, CVE-2026-80706, CVE-2026-80707,\nCVE-2026-80708, CVE-2026-80709, CVE-2026-80710, CVE-2026-80711,\nCVE-2026-80712, CVE-2026-80713, CVE-2026-80714, CVE-2026-80715,\nCVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80720,\nCVE-2026-80721, CVE-2026-80722, CVE-2026-80723, CVE-2026-80724,\nCVE-2026-80727, CVE-2026-80729, CVE-2026-80730, CVE-2026-80731,\nCVE-2026-80732, CVE-2026-80733, CVE-2026-80734, CVE-2026-80735,\nCVE-2026-80736, CVE-2026-80737, CVE-2026-80738, CVE-2026-80739,\nCVE-2026-80740, CVE-2026-80741, CVE-2026-80742, CVE-2026-80743,\nCVE-2026-80744, CVE-2026-80745, CVE-2026-80747, CVE-2026-80748,\nCVE-2026-80749, CVE-2026-80750, CVE-2026-80751, CVE-2026-80752,\nCVE-2026-80753, CVE-2026-80754, CVE-2026-80755, CVE-2026-80756,\nCVE-2026-80757, CVE-2026-80758, CVE-2026-80759, CVE-2026-80760,\nCVE-2026-80761, CVE-2026-80762, CVE-2026-80763, CVE-2026-80764,\nCVE-2026-80765, CVE-2026-80766, CVE-2026-80767, CVE-2026-80768,\nCVE-2026-80769, CVE-2026-80770, CVE-2026-80771, CVE-2026-80772,\nCVE-2026-80774, CVE-2026-80775, CVE-2026-80776, CVE-2026-80777,\nCVE-2026-80778, CVE-2026-80779, CVE-2026-80780, CVE-2026-80781,\nCVE-2026-80782, CVE-2026-80783, CVE-2026-80784, CVE-2026-80785,\nCVE-2026-80786, CVE-2026-80787, CVE-2026-80788, CVE-2026-80789,\nCVE-2026-80790, CVE-2026-80791, CVE-2026-80792, CVE-2026-80793,\nCVE-2026-80794, CVE-2026-80795, CVE-2026-80796, CVE-2026-80797,\nCVE-2026-80798, CVE-2026-80799, CVE-2026-80800, CVE-2026-80801,\nCVE-2026-80802, CVE-2026-80803, CVE-2026-80804, CVE-2026-80805,\nCVE-2026-80806, CVE-2026-80807, CVE-2026-80808, CVE-2026-80809,\nCVE-2026-80810, CVE-2026-80811, CVE-2026-80812, CVE-2026-80813,\nCVE-2026-80814, CVE-2026-80815, CVE-2026-80816, CVE-2026-80817,\nCVE-2026-80818, CVE-2026-80819, CVE-2026-80820, CVE-2026-80821,\nCVE-2026-80822, CVE-2026-80823, CVE-2026-80824, CVE-2026-80825,\nCVE-2026-80826, CVE-2026-80827, CVE-2026-80828, CVE-2026-80829,\nCVE-2026-80830, CVE-2026-80831, CVE-2026-80832, CVE-2026-80833,\nCVE-2026-80834, CVE-2026-80835, CVE-2026-80836, CVE-2026-80837,\nCVE-2026-80838, CVE-2026-80839, CVE-2026-80840, CVE-2026-80841,\nCVE-2026-80842, CVE-2026-80843, CVE-2026-80844, CVE-2026-80845,\nCVE-2026-80846, CVE-2026-80847, CVE-2026-80848, CVE-2026-80849,\nCVE-2026-80850, CVE-2026-80851, CVE-2026-80852, CVE-2026-80854,\nCVE-2026-80855, CVE-2026-80856, CVE-2026-80857, CVE-2026-80858,\nCVE-2026-80859, CVE-2026-80860, CVE-2026-80861, CVE-2026-80862,\nCVE-2026-80863, CVE-2026-80864, CVE-2026-80887, CVE-2026-80888,\nCVE-2026-80889, CVE-2026-80890, CVE-2026-80891, CVE-2026-80892,\nCVE-2026-80893, CVE-2026-80894, CVE-2026-80895, CVE-2026-80896,\nCVE-2026-80897, CVE-2026-80898, CVE-2026-80899, CVE-2026-80900,\nCVE-2026-80901, CVE-2026-80902, CVE-2026-80903, CVE-2026-80904,\nCVE-2026-80905, CVE-2026-80906, CVE-2026-80907, CVE-2026-80908,\nCVE-2026-80909, CVE-2026-80910, CVE-2026-80911, CVE-2026-80912,\nCVE-2026-80913, CVE-2026-80914, CVE-2026-80915, CVE-2026-80916,\nCVE-2026-80917, CVE-2026-80918, CVE-2026-80920, CVE-2026-80921,\nCVE-2026-80922, CVE-2026-80923, CVE-2026-80924, CVE-2026-80925,\nCVE-2026-80926, CVE-2026-80927, CVE-2026-80928, CVE-2026-80929,\nCVE-2026-80930, CVE-2026-80931, CVE-2026-80932, CVE-2026-80933,\nCVE-2026-80934, CVE-2026-80935, CVE-2026-80936, CVE-2026-80937,\nCVE-2026-80938, CVE-2026-80939, CVE-2026-80940, CVE-2026-80941,\nCVE-2026-80942, CVE-2026-80943, CVE-2026-80944, CVE-2026-80945,\nCVE-2026-80946, CVE-2026-80947, CVE-2026-80948, CVE-2026-80949,\nCVE-2026-80950, CVE-2026-80951, CVE-2026-80952, CVE-2026-80953,\nCVE-2026-80954, CVE-2026-80955, CVE-2026-80956, CVE-2026-80957,\nCVE-2026-80958, CVE-2026-80959, CVE-2026-80960, CVE-2026-80961,\nCVE-2026-80962, CVE-2026-80963, CVE-2026-80964, CVE-2026-80965,\nCVE-2026-80966, CVE-2026-80967, CVE-2026-80968, CVE-2026-80969,\nCVE-2026-80970, CVE-2026-80971, CVE-2026-80972, CVE-2026-80973,\nCVE-2026-80974, CVE-2026-80975, CVE-2026-80976, CVE-2026-80977,\nCVE-2026-80978, CVE-2026-80979, CVE-2026-80980, CVE-2026-80981,\nCVE-2026-80982, CVE-2026-80983, CVE-2026-80984, CVE-2026-80985,\nCVE-2026-80986, CVE-2026-80987, CVE-2026-80988, CVE-2026-80989,\nCVE-2026-80990, CVE-2026-80991, CVE-2026-80992, CVE-2026-80993,\nCVE-2026-80994, CVE-2026-80996, CVE-2026-80997, CVE-2026-80999,\nCVE-2026-81000, CVE-2026-81001, CVE-2026-81002, CVE-2026-81003,\nCVE-2026-81004, CVE-2026-81005, CVE-2026-81006, CVE-2026-81007,\nCVE-2026-81008, CVE-2026-81009, CVE-2026-81010, CVE-2026-81011,\nCVE-2026-81012, CVE-2026-81013, CVE-2026-81014, CVE-2026-81015,\nCVE-2026-81016, CVE-2026-81017, CVE-2026-81018, CVE-2026-89437,\nCVE-2026-89438, CVE-2026-89439, CVE-2026-89440, CVE-2026-89441,\nCVE-2026-89442, CVE-2026-89443, CVE-2026-89444, CVE-2026-89445,\nCVE-2026-89446, CVE-2026-89447, CVE-2026-89448, CVE-2026-89449,\nCVE-2026-89450, CVE-2026-89451, CVE-2026-89452, CVE-2026-89453,\nCVE-2026-89454, CVE-2026-89455, CVE-2026-89456, CVE-2026-89457,\nCVE-2026-89458, CVE-2026-89460, CVE-2026-89461, CVE-2026-89462,\nCVE-2026-89463, CVE-2026-89464, CVE-2026-89465, CVE-2026-89466,\nCVE-2026-89467, CVE-2026-89468, CVE-2026-89469, CVE-2026-89470,\nCVE-2026-89471, CVE-2026-89472, CVE-2026-89473, CVE-2026-89474,\nCVE-2026-89475, CVE-2026-89476, CVE-2026-89477, CVE-2026-89478,\nCVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89482,\nCVE-2026-89483, CVE-2026-89484, CVE-2026-89485, CVE-2026-89486,\nCVE-2026-89487, CVE-2026-89488, CVE-2026-89489, CVE-2026-89490,\nCVE-2026-89491, CVE-2026-89492, CVE-2026-89493, CVE-2026-89494,\nCVE-2026-89495, CVE-2026-89496, CVE-2026-89497, CVE-2026-89498,\nCVE-2026-89500, CVE-2026-89501, CVE-2026-89502, CVE-2026-89503,\nCVE-2026-89504, CVE-2026-89506, CVE-2026-89507, CVE-2026-89508,\nCVE-2026-89509, CVE-2026-89510, CVE-2026-89511, CVE-2026-89512,\nCVE-2026-89513, CVE-2026-89514, CVE-2026-89515, CVE-2026-89520,\nCVE-2026-89521, CVE-2026-89522, CVE-2026-89523, CVE-2026-89524,\nCVE-2026-89525, CVE-2026-89526, CVE-2026-89527, CVE-2026-89528,\nCVE-2026-89529, CVE-2026-89530, CVE-2026-89531, CVE-2026-89532,\nCVE-2026-89533, CVE-2026-89534, CVE-2026-89535, CVE-2026-89536,\nCVE-2026-89537, CVE-2026-89538, CVE-2026-89539, CVE-2026-89540,\nCVE-2026-89541, CVE-2026-89542, CVE-2026-89543, CVE-2026-89544,\nCVE-2026-89545, CVE-2026-89546, CVE-2026-89547, CVE-2026-89548,\nCVE-2026-89549, CVE-2026-89550, CVE-2026-89551, CVE-2026-89552,\nCVE-2026-89553, CVE-2026-89554, CVE-2026-89555, CVE-2026-89556,\nCVE-2026-89557, CVE-2026-89558, CVE-2026-89559, CVE-2026-89560,\nCVE-2026-89561, CVE-2026-89562, CVE-2026-89563, CVE-2026-89564,\nCVE-2026-89565, CVE-2026-89566, CVE-2026-89567, CVE-2026-89569,\nCVE-2026-89570, CVE-2026-89571, CVE-2026-89572, CVE-2026-89573,\nCVE-2026-89574, CVE-2026-89575, CVE-2026-89576, CVE-2026-89577,\nCVE-2026-89578, CVE-2026-89579, CVE-2026-89580, CVE-2026-89581,\nCVE-2026-89582, CVE-2026-89583, CVE-2026-89584, CVE-2026-89585,\nCVE-2026-89586, CVE-2026-89587, CVE-2026-89588, CVE-2026-89589,\nCVE-2026-89590, CVE-2026-89591, CVE-2026-89592, CVE-2026-89593,\nCVE-2026-89594, CVE-2026-89595, CVE-2026-89596, CVE-2026-89597,\nCVE-2026-89598, CVE-2026-89599, CVE-2026-89600, CVE-2026-89601,\nCVE-2026-89602, CVE-2026-89604, CVE-2026-89605, CVE-2026-89606,\nCVE-2026-89607, CVE-2026-89608, CVE-2026-89609, CVE-2026-89615,\nCVE-2026-89616, CVE-2026-89617, CVE-2026-89618, CVE-2026-89619,\nCVE-2026-89620, CVE-2026-89621, CVE-2026-89622, CVE-2026-89623,\nCVE-2026-89624, CVE-2026-89625, CVE-2026-89626, CVE-2026-89627,\nCVE-2026-89628, CVE-2026-89629, CVE-2026-89630, CVE-2026-89631,\nCVE-2026-89632, CVE-2026-89633, CVE-2026-89634, CVE-2026-89636,\nCVE-2026-89637, CVE-2026-89638, CVE-2026-89640, CVE-2026-89641,\nCVE-2026-89642, CVE-2026-89643, CVE-2026-89644, CVE-2026-89645,\nCVE-2026-89646, CVE-2026-89647, CVE-2026-89648, CVE-2026-89649,\nCVE-2026-89650, CVE-2026-89651, CVE-2026-89652, CVE-2026-89653,\nCVE-2026-89654, CVE-2026-89655, CVE-2026-89656, CVE-2026-89657,\nCVE-2026-89658, CVE-2026-89659, CVE-2026-89660, CVE-2026-89661,\nCVE-2026-89662, CVE-2026-89663, CVE-2026-89664, CVE-2026-89665,\nCVE-2026-89666, CVE-2026-89667, CVE-2026-89668, CVE-2026-89669,\nCVE-2026-89670, CVE-2026-89671, CVE-2026-89672, CVE-2026-89673,\nCVE-2026-89674, CVE-2026-89675, CVE-2026-89676, CVE-2026-89677,\nCVE-2026-89678, CVE-2026-89679, CVE-2026-89680, CVE-2026-89682,\nCVE-2026-89683, CVE-2026-89684, CVE-2026-89685, CVE-2026-89686,\nCVE-2026-89687, CVE-2026-89688, CVE-2026-89689, CVE-2026-89690,\nCVE-2026-89691, CVE-2026-89692, CVE-2026-89693, CVE-2026-89694,\nCVE-2026-89695, CVE-2026-89696, CVE-2026-89697, CVE-2026-89698,\nCVE-2026-89699, CVE-2026-89700, CVE-2026-89701, CVE-2026-89702,\nCVE-2026-89703, CVE-2026-89704, CVE-2026-89705, CVE-2026-89706,\nCVE-2026-89707, CVE-2026-89708, CVE-2026-89709, CVE-2026-89710,\nCVE-2026-89711, CVE-2026-89712, CVE-2026-89713, CVE-2026-89714,\nCVE-2026-89715, CVE-2026-89716, CVE-2026-89717, CVE-2026-89718,\nCVE-2026-89719, CVE-2026-89720, CVE-2026-89721, CVE-2026-89722,\nCVE-2026-89723, CVE-2026-89724, CVE-2026-89725, CVE-2026-89726,\nCVE-2026-89727, CVE-2026-89728, CVE-2026-89729, CVE-2026-89730,\nCVE-2026-89731, CVE-2026-89732, CVE-2026-89733, CVE-2026-89734,\nCVE-2026-89735, CVE-2026-89736, CVE-2026-89737, CVE-2026-89738,\nCVE-2026-89739, CVE-2026-89740, CVE-2026-89741, CVE-2026-89742,\nCVE-2026-89743, CVE-2026-89744, CVE-2026-89745, CVE-2026-89746,\nCVE-2026-89747, CVE-2026-89749, CVE-2026-89750, CVE-2026-89751,\nCVE-2026-89752, CVE-2026-89753, CVE-2026-89754, CVE-2026-89755,\nCVE-2026-89756, CVE-2026-89757, CVE-2026-89758, CVE-2026-89759,\nCVE-2026-89761, CVE-2026-89762, CVE-2026-89763, CVE-2026-89765,\nCVE-2026-89766, CVE-2026-89767, CVE-2026-89768, CVE-2026-89769,\nCVE-2026-89771, CVE-2026-89775, CVE-2026-89776, CVE-2026-89777,\nCVE-2026-89778, CVE-2026-89779, CVE-2026-89780, CVE-2026-89781,\nCVE-2026-89782, CVE-2026-89783, CVE-2026-89784, CVE-2026-89785,\nCVE-2026-89786, CVE-2026-89787, CVE-2026-89788, CVE-2026-89789,\nCVE-2026-89790, CVE-2026-89791, CVE-2026-89792, CVE-2026-89793,\nCVE-2026-89794, CVE-2026-89795, CVE-2026-89796, CVE-2026-89797,\nCVE-2026-89798, CVE-2026-89799, CVE-2026-89800, CVE-2026-89801,\nCVE-2026-89802, CVE-2026-89803, CVE-2026-89804, CVE-2026-89806,\nCVE-2026-89807, CVE-2026-89808, CVE-2026-89809, CVE-2026-89810,\nCVE-2026-89811, CVE-2026-89812, CVE-2026-89813, CVE-2026-89814,\nCVE-2026-89815, CVE-2026-89816, CVE-2026-89817, CVE-2026-89818,\nCVE-2026-89819, CVE-2026-89820, CVE-2026-89821, CVE-2026-89822,\nCVE-2026-89823, CVE-2026-89824, CVE-2026-89825, CVE-2026-89826,\nCVE-2026-89827, CVE-2026-89828, CVE-2026-89829, CVE-2026-89830,\nCVE-2026-89831, CVE-2026-89832, CVE-2026-89833, CVE-2026-89834,\nCVE-2026-89835, CVE-2026-89836, CVE-2026-89837, CVE-2026-89838,\nCVE-2026-89839, CVE-2026-89840, CVE-2026-89841, CVE-2026-89842,\nCVE-2026-89843, CVE-2026-89844, CVE-2026-89845, CVE-2026-89846,\nCVE-2026-89847, CVE-2026-89848, CVE-2026-89849, CVE-2026-89850,\nCVE-2026-89851, CVE-2026-89852, CVE-2026-89853, CVE-2026-89854,\nCVE-2026-89855, CVE-2026-89856, CVE-2026-89857, CVE-2026-89858,\nCVE-2026-89859, CVE-2026-89860, CVE-2026-89861, CVE-2026-89862,\nCVE-2026-89863, CVE-2026-89864, CVE-2026-89865, CVE-2026-89866,\nCVE-2026-89867, CVE-2026-89868, CVE-2026-89869, CVE-2026-89870,\nCVE-2026-89871, CVE-2026-89872, CVE-2026-89873, CVE-2026-89874,\nCVE-2026-89875, CVE-2026-89876, CVE-2026-89877, CVE-2026-89878,\nCVE-2026-89879, CVE-2026-89880, CVE-2026-89881, CVE-2026-89882,\nCVE-2026-89883, CVE-2026-89884, CVE-2026-89885, CVE-2026-89886,\nCVE-2026-89887, CVE-2026-89888, CVE-2026-89889, CVE-2026-89890,\nCVE-2026-89891, CVE-2026-89892, CVE-2026-89893, CVE-2026-89894,\nCVE-2026-89895, CVE-2026-89896, CVE-2026-89897, CVE-2026-89898,\nCVE-2026-89899, CVE-2026-89901, CVE-2026-89902, CVE-2026-89903,\nCVE-2026-89904, CVE-2026-89905, CVE-2026-89906, CVE-2026-89908,\nCVE-2026-89909, CVE-2026-89911, CVE-2026-89912, CVE-2026-89913,\nCVE-2026-89914, CVE-2026-89915, CVE-2026-89916, CVE-2026-89917,\nCVE-2026-89918, CVE-2026-89919, CVE-2026-89920, CVE-2026-89921,\nCVE-2026-89922, CVE-2026-89923, CVE-2026-89924, CVE-2026-89925,\nCVE-2026-89926, CVE-2026-89927, CVE-2026-89928, CVE-2026-89929,\nCVE-2026-89930, CVE-2026-89931, CVE-2026-89932, CVE-2026-89933,\nCVE-2026-89934, CVE-2026-89935, CVE-2026-89936, CVE-2026-89937,\nCVE-2026-89938, CVE-2026-89939, CVE-2026-89940, CVE-2026-89941,\nCVE-2026-89942, CVE-2026-89944, CVE-2026-89945, CVE-2026-89946,\nCVE-2026-89947, CVE-2026-89948, CVE-2026-89949, CVE-2026-89950,\nCVE-2026-89951, CVE-2026-89952, CVE-2026-89953, CVE-2026-89954,\nCVE-2026-89955, CVE-2026-89956, CVE-2026-89957, CVE-2026-89958,\nCVE-2026-89959, CVE-2026-89960, CVE-2026-89961, CVE-2026-89962,\nCVE-2026-89963, CVE-2026-89964, CVE-2026-89965, CVE-2026-89966,\nCVE-2026-89967, CVE-2026-89968, CVE-2026-89969, CVE-2026-89970,\nCVE-2026-89971, CVE-2026-89972, CVE-2026-89973, CVE-2026-89974,\nCVE-2026-89975, CVE-2026-89976, CVE-2026-89977, CVE-2026-89978,\nCVE-2026-89979, CVE-2026-89981, CVE-2026-89982, CVE-2026-89983,\nCVE-2026-89984, CVE-2026-89986, CVE-2026-89987, CVE-2026-89988,\nCVE-2026-89989, CVE-2026-89990, CVE-2026-89991, CVE-2026-89992,\nCVE-2026-89993, CVE-2026-89994, CVE-2026-89995, CVE-2026-89996,\nCVE-2026-89997, CVE-2026-89998, CVE-2026-89999, CVE-2026-90000,\nCVE-2026-90001, CVE-2026-90002, CVE-2026-90003, CVE-2026-90005,\nCVE-2026-90006, CVE-2026-90007, CVE-2026-90008, CVE-2026-90011,\nCVE-2026-90012, CVE-2026-90013, CVE-2026-90014, CVE-2026-90015,\nCVE-2026-90016, CVE-2026-90017, CVE-2026-90018, CVE-2026-90019,\nCVE-2026-90020, CVE-2026-90021, CVE-2026-90022, CVE-2026-90023,\nCVE-2026-90024, CVE-2026-90025, CVE-2026-90026, CVE-2026-90027,\nCVE-2026-90028, CVE-2026-90029, CVE-2026-90030, CVE-2026-90031,\nCVE-2026-90032, CVE-2026-90033, CVE-2026-90034, CVE-2026-90035,\nCVE-2026-90036, CVE-2026-90037, CVE-2026-90039, CVE-2026-90040,\nCVE-2026-90041, CVE-2026-90042, CVE-2026-90043, CVE-2026-90044,\nCVE-2026-90045, CVE-2026-90046, CVE-2026-90047, CVE-2026-90048,\nCVE-2026-90049, CVE-2026-90051, CVE-2026-90053, CVE-2026-90054,\nCVE-2026-90055, CVE-2026-90056, CVE-2026-90057, CVE-2026-90058,\nCVE-2026-90059, CVE-2026-90060, CVE-2026-90061, CVE-2026-90062,\nCVE-2026-90063, CVE-2026-90065, CVE-2026-90066, CVE-2026-90067,\nCVE-2026-90068, CVE-2026-90069, CVE-2026-90070, CVE-2026-90071,\nCVE-2026-90072, CVE-2026-90073, CVE-2026-90074, CVE-2026-90075,\nCVE-2026-90076, CVE-2026-90077, CVE-2026-90078, CVE-2026-90079,\nCVE-2026-90080, CVE-2026-90081, CVE-2026-90082, CVE-2026-90083,\nCVE-2026-90084, CVE-2026-90085, CVE-2026-90086, CVE-2026-90087,\nCVE-2026-90088, CVE-2026-90089, CVE-2026-90090, CVE-2026-90091,\nCVE-2026-90092, CVE-2026-90093, CVE-2026-90094, CVE-2026-90095,\nCVE-2026-90097, CVE-2026-90099, CVE-2026-90100, CVE-2026-90101,\nCVE-2026-90102, CVE-2026-90103, CVE-2026-90104, CVE-2026-90105,\nCVE-2026-90106, CVE-2026-90107, CVE-2026-90108, CVE-2026-90109,\nCVE-2026-90110, CVE-2026-90111, CVE-2026-90112, CVE-2026-90113,\nCVE-2026-90114, CVE-2026-90115, CVE-2026-90116, CVE-2026-90119,\nCVE-2026-90120, CVE-2026-90121, CVE-2026-90122, CVE-2026-90124,\nCVE-2026-90125, CVE-2026-90126, CVE-2026-90127, CVE-2026-90128,\nCVE-2026-90129, CVE-2026-90130, CVE-2026-90135, CVE-2026-90136,\nCVE-2026-90137, CVE-2026-90138, CVE-2026-90139, CVE-2026-90140,\nCVE-2026-90141, CVE-2026-90142, CVE-2026-90143, CVE-2026-90145,\nCVE-2026-90146, CVE-2026-90147, CVE-2026-90148, CVE-2026-90149,\nCVE-2026-90150, CVE-2026-90151, CVE-2026-90152, CVE-2026-90153,\nCVE-2026-90154, CVE-2026-90156, CVE-2026-90157, CVE-2026-90158,\nCVE-2026-90159, CVE-2026-90160, CVE-2026-90161, CVE-2026-90163,\nCVE-2026-90164, CVE-2026-90165, CVE-2026-90166, CVE-2026-90169,\nCVE-2026-90170, CVE-2026-90174, CVE-2026-90175, CVE-2026-90176,\nCVE-2026-90177, CVE-2026-90178, CVE-2026-90179, CVE-2026-90180,\nCVE-2026-90182, CVE-2026-90183, CVE-2026-90184, CVE-2026-90185,\nCVE-2026-90186, CVE-2026-90187, CVE-2026-90188, CVE-2026-90189,\nCVE-2026-90190, CVE-2026-90191, CVE-2026-90192, CVE-2026-90193,\nCVE-2026-90194, CVE-2026-90195, CVE-2026-90196, CVE-2026-90197,\nCVE-2026-90198, CVE-2026-90199, CVE-2026-90200, CVE-2026-90201,\nCVE-2026-90202, CVE-2026-90203, CVE-2026-90204, CVE-2026-90205,\nCVE-2026-90206, CVE-2026-90207, CVE-2026-90208, CVE-2026-90209,\nCVE-2026-90211, CVE-2026-90212, CVE-2026-90213, CVE-2026-90214,\nCVE-2026-90215, CVE-2026-90216, CVE-2026-90217, CVE-2026-90218,\nCVE-2026-90219, CVE-2026-90220, CVE-2026-90221, CVE-2026-90222,\nCVE-2026-90223, CVE-2026-90224, CVE-2026-90225, CVE-2026-90226,\nCVE-2026-90227, CVE-2026-90228, CVE-2026-90229, CVE-2026-90230,\nCVE-2026-90231, CVE-2026-90232, CVE-2026-90233, CVE-2026-90234,\nCVE-2026-90235, CVE-2026-90237, CVE-2026-90240, CVE-2026-90241,\nCVE-2026-90242, CVE-2026-90243, CVE-2026-90244, CVE-2026-90245,\nCVE-2026-90246, CVE-2026-90247, CVE-2026-90248, CVE-2026-90249,\nCVE-2026-90250, CVE-2026-90251, CVE-2026-90252, CVE-2026-90253,\nCVE-2026-90254, CVE-2026-90255, CVE-2026-90256, CVE-2026-90257,\nCVE-2026-90258, CVE-2026-90259, CVE-2026-90260, CVE-2026-90261,\nCVE-2026-90262, CVE-2026-90263, CVE-2026-90264, CVE-2026-90265,\nCVE-2026-90267, CVE-2026-90269, CVE-2026-90270, CVE-2026-90271,\nCVE-2026-90272, CVE-2026-90273, CVE-2026-90274, CVE-2026-90275,\nCVE-2026-90276, CVE-2026-90277, CVE-2026-90278, CVE-2026-90279,\nCVE-2026-90280, CVE-2026-90281, CVE-2026-90282, CVE-2026-90283,\nCVE-2026-90284, CVE-2026-90285, CVE-2026-90286, CVE-2026-90287,\nCVE-2026-90288, CVE-2026-90289, CVE-2026-90290, CVE-2026-90291,\nCVE-2026-90292, CVE-2026-90293, CVE-2026-90294, CVE-2026-90295,\nCVE-2026-90296, CVE-2026-90297, CVE-2026-90298, CVE-2026-90300,\nCVE-2026-90301, CVE-2026-90302, CVE-2026-90303, CVE-2026-90306,\nCVE-2026-90307, CVE-2026-90308, CVE-2026-90309, CVE-2026-90311,\nCVE-2026-90312, CVE-2026-90313, CVE-2026-90314, CVE-2026-90315,\nCVE-2026-90316, CVE-2026-90318, CVE-2026-90319, CVE-2026-90320,\nCVE-2026-90321, CVE-2026-90322, CVE-2026-90323, CVE-2026-90324,\nCVE-2026-90325, CVE-2026-90326, CVE-2026-90327, CVE-2026-90328,\nCVE-2026-90329, CVE-2026-90330, CVE-2026-90331, CVE-2026-90332,\nCVE-2026-90333, CVE-2026-90334, CVE-2026-90335, CVE-2026-90336,\nCVE-2026-90337, CVE-2026-90338, CVE-2026-90341, CVE-2026-90342,\nCVE-2026-90343, CVE-2026-90344, CVE-2026-90345, CVE-2026-90346,\nCVE-2026-90347, CVE-2026-90348, CVE-2026-90349, CVE-2026-90350,\nCVE-2026-90351, CVE-2026-90352, CVE-2026-90353, CVE-2026-90354,\nCVE-2026-90355, CVE-2026-90356, CVE-2026-90357, CVE-2026-90358,\nCVE-2026-90359, CVE-2026-90360, CVE-2026-90361, CVE-2026-90362,\nCVE-2026-90363, CVE-2026-90364, CVE-2026-90365, CVE-2026-90366,\nCVE-2026-90367, CVE-2026-90368, CVE-2026-90369, CVE-2026-90370,\nCVE-2026-90371, CVE-2026-90372, CVE-2026-90373, CVE-2026-90374,\nCVE-2026-90375, CVE-2026-90376, CVE-2026-90377, CVE-2026-90378,\nCVE-2026-90379, CVE-2026-90380, CVE-2026-90381, CVE-2026-90382,\nCVE-2026-90383, CVE-2026-90384, CVE-2026-90385, CVE-2026-90386,\nCVE-2026-90387, CVE-2026-90388, CVE-2026-90389, CVE-2026-90390,\nCVE-2026-90391, CVE-2026-90392, CVE-2026-90393, CVE-2026-90394,\nCVE-2026-90395, CVE-2026-90396, CVE-2026-90397, CVE-2026-90398,\nCVE-2026-90399, CVE-2026-90400, CVE-2026-90401, CVE-2026-90402,\nCVE-2026-90403, CVE-2026-90404, CVE-2026-90406, CVE-2026-90407,\nCVE-2026-90408, CVE-2026-90409, CVE-2026-90410, CVE-2026-90411,\nCVE-2026-90412, CVE-2026-90413, CVE-2026-90414, CVE-2026-90415,\nCVE-2026-90416, CVE-2026-90417, CVE-2026-90418, CVE-2026-90419,\nCVE-2026-90420, CVE-2026-90421, CVE-2026-90422, CVE-2026-90423,\nCVE-2026-90424, CVE-2026-90425, CVE-2026-90426, CVE-2026-90427,\nCVE-2026-90428, CVE-2026-90429, CVE-2026-90430, CVE-2026-90431,\nCVE-2026-90433, CVE-2026-90434, CVE-2026-90435, CVE-2026-92476,\nCVE-2026-92477, CVE-2026-92479, CVE-2026-92480, CVE-2026-92481,\nCVE-2026-92482, CVE-2026-92483, CVE-2026-92484, CVE-2026-92485,\nCVE-2026-92486, CVE-2026-92488, CVE-2026-92489, CVE-2026-92490,\nCVE-2026-92491, CVE-2026-92493, CVE-2026-92494, CVE-2026-92495,\nCVE-2026-92496, CVE-2026-92497, CVE-2026-92498, CVE-2026-92499,\nCVE-2026-92500, CVE-2026-92501, CVE-2026-92503, CVE-2026-92504,\nCVE-2026-92505, CVE-2026-92506, CVE-2026-92507, CVE-2026-92508,\nCVE-2026-92509, CVE-2026-92510, CVE-2026-92511, CVE-2026-92512,\nCVE-2026-92513, CVE-2026-92514, CVE-2026-92515, CVE-2026-92516,\nCVE-2026-92517, CVE-2026-92518, CVE-2026-92519, CVE-2026-92520,\nCVE-2026-92521, CVE-2026-92522, CVE-2026-92523, CVE-2026-92524,\nCVE-2026-92525, CVE-2026-93037, CVE-2026-93039, CVE-2026-93040,\nCVE-2026-93041, CVE-2026-93042, CVE-2026-93043, CVE-2026-93044,\nCVE-2026-93045, CVE-2026-93046, CVE-2026-93047, CVE-2026-93048,\nCVE-2026-93049, CVE-2026-93050, CVE-2026-93051, CVE-2026-93052,\nCVE-2026-93053, CVE-2026-93054, CVE-2026-93055, CVE-2026-93056,\nCVE-2026-93058, CVE-2026-93059, CVE-2026-93061, CVE-2026-93062,\nCVE-2026-93063, CVE-2026-93064, CVE-2026-93065, CVE-2026-93066,\nCVE-2026-93067, CVE-2026-93068, CVE-2026-93069, CVE-2026-93070,\nCVE-2026-93071, CVE-2026-93072, CVE-2026-93073, CVE-2026-93077,\nCVE-2026-93078, CVE-2026-93079, CVE-2026-93080, CVE-2026-93081,\nCVE-2026-93082, CVE-2026-93083, CVE-2026-93084, CVE-2026-93085,\nCVE-2026-93086, CVE-2026-93089, CVE-2026-93090, CVE-2026-93091,\nCVE-2026-93092, CVE-2026-93093, CVE-2026-93094, CVE-2026-93095,\nCVE-2026-93096, CVE-2026-93097, CVE-2026-93098, CVE-2026-93099,\nCVE-2026-93100, CVE-2026-93101, CVE-2026-93102, CVE-2026-93103,\nCVE-2026-93104, CVE-2026-93105, CVE-2026-93106, CVE-2026-93107,\nCVE-2026-93108, CVE-2026-93109, CVE-2026-93110, CVE-2026-93112,\nCVE-2026-93113, CVE-2026-93114, CVE-2026-93115, CVE-2026-93116,\nCVE-2026-93117, CVE-2026-93118, CVE-2026-93119, CVE-2026-93120,\nCVE-2026-93121, CVE-2026-93122, CVE-2026-93123, CVE-2026-93125,\nCVE-2026-93126, CVE-2026-93127, CVE-2026-93128, CVE-2026-93129,\nCVE-2026-93130, CVE-2026-93131, CVE-2026-93132, CVE-2026-93133,\nCVE-2026-93134, CVE-2026-93135, CVE-2026-93136, CVE-2026-93137,\nCVE-2026-93138, CVE-2026-93140, CVE-2026-93141, CVE-2026-93142,\nCVE-2026-93143, CVE-2026-93144, CVE-2026-93145, CVE-2026-93146,\nCVE-2026-93148, CVE-2026-93149, CVE-2026-93150, CVE-2026-93151,\nCVE-2026-93152, CVE-2026-93153, CVE-2026-93154, CVE-2026-93155,\nCVE-2026-93156, CVE-2026-93157, CVE-2026-93158, CVE-2026-93159,\nCVE-2026-93160, CVE-2026-93161, CVE-2026-93162, CVE-2026-93163,\nCVE-2026-93164, CVE-2026-93165, CVE-2026-93167, CVE-2026-93168,\nCVE-2026-93169, CVE-2026-93170, CVE-2026-93172, CVE-2026-93173,\nCVE-2026-93174, CVE-2026-93176, CVE-2026-93177, CVE-2026-93178,\nCVE-2026-93179, CVE-2026-93181, CVE-2026-93182, CVE-2026-93183,\nCVE-2026-93184, CVE-2026-93185, CVE-2026-93186, CVE-2026-93188,\nCVE-2026-93189, CVE-2026-93190, CVE-2026-93191, CVE-2026-93192,\nCVE-2026-93193, CVE-2026-93194, CVE-2026-93195, CVE-2026-93196,\nCVE-2026-93198, CVE-2026-93199, CVE-2026-93200, CVE-2026-93201,\nCVE-2026-93202, CVE-2026-93203, CVE-2026-93204, CVE-2026-93205,\nCVE-2026-93206, CVE-2026-93207, CVE-2026-93208, CVE-2026-93209,\nCVE-2026-93210, CVE-2026-93211, CVE-2026-93212, CVE-2026-93213,\nCVE-2026-93214, CVE-2026-93215, CVE-2026-93216, CVE-2026-93217,\nCVE-2026-93218, CVE-2026-93219, CVE-2026-93220, CVE-2026-93221,\nCVE-2026-93222, CVE-2026-93223, CVE-2026-93224, CVE-2026-93225,\nCVE-2026-93226, CVE-2026-93227, CVE-2026-93228, CVE-2026-93229,\nCVE-2026-93230, CVE-2026-93231, CVE-2026-93233, CVE-2026-93234,\nCVE-2026-93235, CVE-2026-93236, CVE-2026-93237, CVE-2026-93238,\nCVE-2026-93239, CVE-2026-93240, CVE-2026-93241, CVE-2026-93242,\nCVE-2026-93243, CVE-2026-93244, CVE-2026-93245, CVE-2026-93247,\nCVE-2026-93248, CVE-2026-93249, CVE-2026-93250, CVE-2026-93251,\nCVE-2026-93252, CVE-2026-93253, CVE-2026-93256, CVE-2026-93258,\nCVE-2026-93259, CVE-2026-93260, CVE-2026-93261, CVE-2026-93262,\nCVE-2026-93264, CVE-2026-93265, CVE-2026-93266, CVE-2026-93267,\nCVE-2026-93268, CVE-2026-93269, CVE-2026-93270, CVE-2026-93271,\nCVE-2026-93272, CVE-2026-93273, CVE-2026-93274, CVE-2026-93275,\nCVE-2026-93276, CVE-2026-93280, CVE-2026-93281, CVE-2026-93282,\nCVE-2026-93283, CVE-2026-93284, CVE-2026-93285, CVE-2026-93286,\nCVE-2026-93287, CVE-2026-93288, CVE-2026-93781, CVE-2026-93782,\nCVE-2026-93783, CVE-2026-93784, CVE-2026-93785, CVE-2026-93786,\nCVE-2026-93787, CVE-2026-93788, CVE-2026-93789, CVE-2026-93790,\nCVE-2026-93791, CVE-2026-93792, CVE-2026-93793, CVE-2026-93794,\nCVE-2026-93795, CVE-2026-93796, CVE-2026-93797, CVE-2026-93798,\nCVE-2026-93799, CVE-2026-93800, CVE-2026-93801, CVE-2026-93802,\nCVE-2026-93803, CVE-2026-93804, CVE-2026-93805, CVE-2026-93806,\nCVE-2026-93807, CVE-2026-93808, CVE-2026-93809, CVE-2026-93810,\nCVE-2026-93811, CVE-2026-93812, CVE-2026-93813, CVE-2026-93814,\nCVE-2026-93815, CVE-2026-93816, CVE-2026-93817, CVE-2026-93818,\nCVE-2026-93819, CVE-2026-93820, CVE-2026-93821, CVE-2026-93822,\nCVE-2026-93823, CVE-2026-93824, CVE-2026-93825, CVE-2026-93826,\nCVE-2026-93827, CVE-2026-93828, CVE-2026-93829, CVE-2026-93830,\nCVE-2026-97407, CVE-2026-97408, CVE-2026-97409, CVE-2026-97410,\nCVE-2026-97411, CVE-2026-97412, CVE-2026-97413, CVE-2026-97414,\nCVE-2026-97415, CVE-2026-97416, CVE-2026-97417, CVE-2026-97418,\nCVE-2026-97419, CVE-2026-97420, CVE-2026-97421, CVE-2026-97422,\nCVE-2026-97423, CVE-2026-97424, CVE-2026-97425, CVE-2026-97426,\nCVE-2026-97427, CVE-2026-97428, CVE-2026-97429, CVE-2026-97430,\nCVE-2026-97431, CVE-2026-97432, CVE-2026-97433, CVE-2026-97434,\nCVE-2026-97435, CVE-2026-97436, CVE-2026-97437, CVE-2026-97438,\nCVE-2026-97439, CVE-2026-97440, CVE-2026-97441, CVE-2026-97442,\nCVE-2026-97443, CVE-2026-97444, CVE-2026-97445, CVE-2026-97446,\nCVE-2026-97447, CVE-2026-97448, CVE-2026-97449, CVE-2026-97450,\nCVE-2026-97451, CVE-2026-97452, CVE-2026-97453, CVE-2026-97454,\nCVE-2026-97455, CVE-2026-97456, CVE-2026-97472, CVE-2026-97473,\nCVE-2026-97474, CVE-2026-97475, CVE-2026-97476, CVE-2026-97477,\nCVE-2026-97478, CVE-2026-97479, CVE-2026-97480, CVE-2026-97481,\nCVE-2026-97482, CVE-2026-97483, CVE-2026-97484, CVE-2026-97485,\nCVE-2026-97486, CVE-2026-97487, CVE-2026-97488, CVE-2026-97489,\nCVE-2026-97490, CVE-2026-97491, CVE-2026-97492, CVE-2026-97493,\nCVE-2026-97494, CVE-2026-97495, CVE-2026-97496, CVE-2026-97497,\nCVE-2026-97498, CVE-2026-97499, CVE-2026-97500, CVE-2026-97501,\nCVE-2026-97502, CVE-2026-97503, CVE-2026-97505, CVE-2026-97506,\nCVE-2026-97507, CVE-2026-97511, CVE-2026-97512, CVE-2026-97513,\nCVE-2026-97514, CVE-2026-97515, CVE-2026-97516, CVE-2026-97517,\nCVE-2026-97518, CVE-2026-97519, CVE-2026-97520, CVE-2026-97521,\nCVE-2026-97522, CVE-2026-97523, CVE-2026-97524, CVE-2026-97525,\nCVE-2026-97526, CVE-2026-97527, CVE-2026-97528, CVE-2026-97529,\nCVE-2026-97530, CVE-2026-97531, CVE-2026-97532, CVE-2026-97533,\nCVE-2026-97534, CVE-2026-97535, CVE-2026-97536, CVE-2026-97537,\nCVE-2026-97538, CVE-2026-97539, CVE-2026-97540, CVE-2026-97541,\nCVE-2026-97542, CVE-2026-97543, CVE-2026-97544, CVE-2026-97545,\nCVE-2026-97546, CVE-2026-97547, CVE-2026-97548, CVE-2026-97549,\nCVE-2026-97550, CVE-2026-97551, CVE-2026-97552, CVE-2026-97553,\nCVE-2026-97554, CVE-2026-97555, CVE-2026-97556, CVE-2026-97557,\nCVE-2026-97558, CVE-2026-97559, CVE-2026-97560, CVE-2026-97561,\nCVE-2026-97562, CVE-2026-97563, CVE-2026-97564, CVE-2026-97565,\nCVE-2026-97566, CVE-2026-97567, CVE-2026-97568, CVE-2026-97571,\nCVE-2026-97572, CVE-2026-97573, CVE-2026-97574, CVE-2026-97575,\nCVE-2026-97576, CVE-2026-97577, CVE-2026-97578, CVE-2026-97579,\nCVE-2026-97580, CVE-2026-97581, CVE-2026-97582, CVE-2026-97583,\nCVE-2026-97584, CVE-2026-97585, CVE-2026-97586, CVE-2026-97587,\nCVE-2026-97588, CVE-2026-97589, CVE-2026-97590, CVE-2026-97591,\nCVE-2026-97592, CVE-2026-97593, CVE-2026-97594, CVE-2026-97595,\nCVE-2026-97596, CVE-2026-97597, CVE-2026-97598, CVE-2026-97599,\nCVE-2026-97600, CVE-2026-97601, CVE-2026-97602, CVE-2026-97603,\nCVE-2026-97604, CVE-2026-97605, CVE-2026-97606, CVE-2026-97607,\nCVE-2026-97608, CVE-2026-97609, CVE-2026-97610, CVE-2026-97611,\nCVE-2026-97612, CVE-2026-97613, CVE-2026-97614, CVE-2026-97615,\nCVE-2026-97616, CVE-2026-97617, CVE-2026-97618, CVE-2026-97619,\nCVE-2026-97620, CVE-2026-97621, CVE-2026-97899, CVE-2026-97900,\nCVE-2026-97901, CVE-2026-97902, CVE-2026-97903, CVE-2026-97904,\nCVE-2026-97905, CVE-2026-97906, CVE-2026-97907, CVE-2026-97908,\nCVE-2026-97909, CVE-2026-97910, CVE-2026-97912, CVE-2026-97913,\nCVE-2026-97914, CVE-2026-97915, CVE-2026-97916, CVE-2026-97917,\nCVE-2026-97918, CVE-2026-97919, CVE-2026-97920, CVE-2026-97921,\nCVE-2026-97922, CVE-2026-97923, CVE-2026-97924, CVE-2026-97925,\nCVE-2026-97926, CVE-2026-97927, CVE-2026-97928, CVE-2026-97929,\nCVE-2026-97930, CVE-2026-97931, CVE-2026-97932, CVE-2026-97933,\nCVE-2026-97934, CVE-2026-97935, CVE-2026-97936, CVE-2026-97938,\nCVE-2026-97939, CVE-2026-97940, CVE-2026-97942, CVE-2026-97943,\nCVE-2026-97944, CVE-2026-97945, CVE-2026-97946, CVE-2026-97947,\nCVE-2026-97948, CVE-2026-97950, CVE-2026-97951, CVE-2026-97953,\nCVE-2026-97954, CVE-2026-97955, CVE-2026-97956, CVE-2026-97957,\nCVE-2026-97958, CVE-2026-97959, CVE-2026-97960, CVE-2026-97961,\nCVE-2026-97962, CVE-2026-97963, CVE-2026-97964, CVE-2026-97965,\nCVE-2026-97966, CVE-2026-97967, CVE-2026-97968, CVE-2026-97969,\nCVE-2026-97970, CVE-2026-97971, CVE-2026-97972, CVE-2026-97973,\nCVE-2026-97974, CVE-2026-97975, CVE-2026-97976, CVE-2026-97977,\nCVE-2026-97978, CVE-2026-97979, CVE-2026-97981, CVE-2026-97982,\nCVE-2026-97983, CVE-2026-97984, CVE-2026-97985, CVE-2026-97986,\nCVE-2026-97987, CVE-2026-97988, CVE-2026-97989, CVE-2026-97990,\nCVE-2026-97991, CVE-2026-97992, CVE-2026-97993, CVE-2026-97994,\nCVE-2026-97995, CVE-2026-97996, CVE-2026-97997, CVE-2026-97998,\nCVE-2026-98000, CVE-2026-98001, CVE-2026-98002, CVE-2026-98003,\nCVE-2026-98004, CVE-2026-98005, CVE-2026-98006, CVE-2026-98007,\nCVE-2026-98008, CVE-2026-98009, CVE-2026-98010, CVE-2026-98011,\nCVE-2026-98012, CVE-2026-98013, CVE-2026-98014, CVE-2026-98015,\nCVE-2026-98016, CVE-2026-98017, CVE-2026-98018, CVE-2026-98019,\nCVE-2026-98020, CVE-2026-98021, CVE-2026-98022, CVE-2026-98023,\nCVE-2026-98024, CVE-2026-98025, CVE-2026-98026, CVE-2026-98027,\nCVE-2026-98028, CVE-2026-98029, CVE-2026-98030, CVE-2026-98031,\nCVE-2026-98032, CVE-2026-98033, CVE-2026-98034, CVE-2026-98037,\nCVE-2026-98039, CVE-2026-98041, CVE-2026-98043, CVE-2026-98044,\nCVE-2026-98045, CVE-2026-98046, CVE-2026-98047, CVE-2026-98048,\nCVE-2026-98049, CVE-2026-98050, CVE-2026-98051, CVE-2026-98052,\nCVE-2026-98053, CVE-2026-98054, CVE-2026-98055, CVE-2026-98056,\nCVE-2026-98057, CVE-2026-98058, CVE-2026-98059, CVE-2026-98060,\nCVE-2026-98061, CVE-2026-98062, CVE-2026-98063, CVE-2026-98064,\nCVE-2026-98065, CVE-2026-98066, CVE-2026-98067, CVE-2026-98068,\nCVE-2026-98069, CVE-2026-98070, CVE-2026-98071, CVE-2026-98072,\nCVE-2026-98073, CVE-2026-98074, CVE-2026-98075, CVE-2026-98076,\nCVE-2026-98077, CVE-2026-98078, CVE-2026-98079, CVE-2026-98080,\nCVE-2026-98081, CVE-2026-98082, CVE-2026-98083, CVE-2026-98084,\nCVE-2026-98085, CVE-2026-98086, CVE-2026-98087, CVE-2026-98088,\nCVE-2026-98089, CVE-2026-98090, CVE-2026-98091, CVE-2026-98092,\nCVE-2026-98093, CVE-2026-98094, CVE-2026-98095, CVE-2026-98096,\nCVE-2026-98097, CVE-2026-98098, CVE-2026-98099, CVE-2026-98101,\nCVE-2026-98102, CVE-2026-98103, CVE-2026-98104, CVE-2026-98105,\nCVE-2026-98106, CVE-2026-98107, CVE-2026-98108, CVE-2026-98109,\nCVE-2026-98110, CVE-2026-98111, CVE-2026-98112, CVE-2026-98113,\nCVE-2026-98114, CVE-2026-98115, CVE-2026-98116, CVE-2026-98117,\nCVE-2026-98118, CVE-2026-98119, CVE-2026-98120, CVE-2026-98121,\nCVE-2026-98122, CVE-2026-98123, CVE-2026-98124, CVE-2026-98125,\nCVE-2026-98126, CVE-2026-98127, CVE-2026-98128, CVE-2026-98129,\nCVE-2026-98130, CVE-2026-98131, CVE-2026-98134, CVE-2026-98142,\nCVE-2026-98143, CVE-2026-98146, CVE-2026-98147, CVE-2026-98148,\nCVE-2026-98149, CVE-2026-98150, CVE-2026-98151, CVE-2026-98152,\nCVE-2026-98153, CVE-2026-98154, CVE-2026-98155, CVE-2026-98156,\nCVE-2026-98157, CVE-2026-98158, CVE-2026-98159, CVE-2026-98160,\nCVE-2026-98161, CVE-2026-98162, CVE-2026-98163, CVE-2026-98164,\nCVE-2026-98166, CVE-2026-98167, CVE-2026-98168, CVE-2026-98169,\nCVE-2026-98170, CVE-2026-98171, CVE-2026-98172, CVE-2026-98173,\nCVE-2026-98174, CVE-2026-98175, CVE-2026-98176, CVE-2026-98177,\nCVE-2026-98179, CVE-2026-98180, CVE-2026-98181, CVE-2026-98182,\nCVE-2026-98184, CVE-2026-98185, CVE-2026-98186, CVE-2026-98187,\nCVE-2026-98188, CVE-2026-98189, CVE-2026-98190, CVE-2026-98191,\nCVE-2026-98192, CVE-2026-98193, CVE-2026-98194, CVE-2026-98195,\nCVE-2026-98196, CVE-2026-98197, CVE-2026-98198, CVE-2026-98199,\nCVE-2026-98200, CVE-2026-98201, CVE-2026-98202, CVE-2026-98203,\nCVE-2026-98204, CVE-2026-98205, CVE-2026-98206, CVE-2026-98207,\nCVE-2026-98208, CVE-2026-98209, CVE-2026-98210, CVE-2026-98211,\nCVE-2026-98212, CVE-2026-98213, CVE-2026-98214, CVE-2026-98215,\nCVE-2026-98216, CVE-2026-98217, CVE-2026-98218, CVE-2026-98221,\nCVE-2026-98222, CVE-2026-98223, CVE-2026-98224, CVE-2026-98226,\nCVE-2026-98227, CVE-2026-98228, CVE-2026-98229, CVE-2026-98230,\nCVE-2026-98231, CVE-2026-98232, CVE-2026-98233, CVE-2026-98234,\nCVE-2026-98235, CVE-2026-98236, CVE-2026-98237, CVE-2026-98238,\nCVE-2026-98239, CVE-2026-98240, CVE-2026-98241, CVE-2026-98242,\nCVE-2026-98244, CVE-2026-98245, CVE-2026-98246, CVE-2026-98247,\nCVE-2026-98248, CVE-2026-98249, CVE-2026-98251, CVE-2026-98252,\nCVE-2026-98253, CVE-2026-98254, CVE-2026-98255, CVE-2026-98256,\nCVE-2026-98257, CVE-2026-98258, CVE-2026-98259, CVE-2026-98260,\nCVE-2026-98261, CVE-2026-98262, CVE-2026-98263, CVE-2026-98264,\nCVE-2026-98265, CVE-2026-98266, CVE-2026-98267, CVE-2026-98268,\nCVE-2026-98269, CVE-2026-98270, CVE-2026-98271, CVE-2026-98272,\nCVE-2026-98273, CVE-2026-98274, CVE-2026-98275, CVE-2026-98276,\nCVE-2026-98277, CVE-2026-98278, CVE-2026-98279, CVE-2026-98280,\nCVE-2026-98281, CVE-2026-98282, CVE-2026-98283, CVE-2026-98284,\nCVE-2026-98285, CVE-2026-98286, CVE-2026-98287, CVE-2026-98288,\nCVE-2026-98289, CVE-2026-98290, CVE-2026-98291, CVE-2026-98292,\nCVE-2026-98293, CVE-2026-98294, CVE-2026-98295, CVE-2026-98296,\nCVE-2026-98297, CVE-2026-98298, CVE-2026-98299, CVE-2026-98300,\nCVE-2026-98301, CVE-2026-98302, CVE-2026-98303, CVE-2026-98304,\nCVE-2026-98306, CVE-2026-98307, CVE-2026-98308, CVE-2026-98309,\nCVE-2026-98311, CVE-2026-98312, CVE-2026-98314, CVE-2026-98317,\nCVE-2026-98318, CVE-2026-98319, CVE-2026-98320, CVE-2026-98321,\nCVE-2026-98322, CVE-2026-98323, CVE-2026-98324, CVE-2026-98325,\nCVE-2026-98326, CVE-2026-98327, CVE-2026-98328, CVE-2026-98329,\nCVE-2026-98330, CVE-2026-98331, CVE-2026-98332, CVE-2026-98333,\nCVE-2026-98334, CVE-2026-98335, CVE-2026-98336, CVE-2026-98337,\nCVE-2026-98338, CVE-2026-98339, CVE-2026-98340, CVE-2026-98341,\nCVE-2026-98342, CVE-2026-98343, CVE-2026-98344, CVE-2026-98345,\nCVE-2026-98346, CVE-2026-98347, CVE-2026-98348, CVE-2026-98349,\nCVE-2026-98350, CVE-2026-98351, CVE-2026-98352, CVE-2026-98354,\nCVE-2026-98355, CVE-2026-98356, CVE-2026-98357, CVE-2026-98358,\nCVE-2026-98359, CVE-2026-98360, CVE-2026-98361, CVE-2026-98362,\nCVE-2026-98363, CVE-2026-98364, CVE-2026-98365, CVE-2026-98366,\nCVE-2026-98367, CVE-2026-98368, CVE-2026-98369, CVE-2026-98370,\nCVE-2026-98371, CVE-2026-98372, CVE-2026-98373, CVE-2026-98374,\nCVE-2026-98377, CVE-2026-98378, CVE-2026-98379, CVE-2026-98380,\nCVE-2026-98381, CVE-2026-98382, CVE-2026-98383, CVE-2026-98384,\nCVE-2026-98386, CVE-2026-98387, CVE-2026-98388, CVE-2026-98389,\nCVE-2026-98390, CVE-2026-98391, CVE-2026-98392, CVE-2026-98393,\nCVE-2026-98394, CVE-2026-98398, CVE-2026-98399, CVE-2026-98400,\nCVE-2026-98401, CVE-2026-98402, CVE-2026-98403, CVE-2026-98404,\nCVE-2026-98406, CVE-2026-98407, CVE-2026-98408, CVE-2026-98409,\nCVE-2026-98410, CVE-2026-98411, CVE-2026-98412, CVE-2026-98413,\nCVE-2026-98414, CVE-2026-98415, CVE-2026-98416, CVE-2026-98417,\nCVE-2026-98419, CVE-2026-98421, CVE-2026-98422, CVE-2026-98423,\nCVE-2026-98424, CVE-2026-98425, CVE-2026-98426, CVE-2026-98427,\nCVE-2026-98428, CVE-2026-98429, CVE-2026-98430, CVE-2026-98431,\nCVE-2026-98433, CVE-2026-98434, CVE-2026-98435, CVE-2026-98436,\nCVE-2026-98437, CVE-2026-98439, CVE-2026-98440, CVE-2026-98441,\nCVE-2026-98442, CVE-2026-98443, CVE-2026-98444, CVE-2026-98445,\nCVE-2026-98446, CVE-2026-98447, CVE-2026-98448, CVE-2026-98449,\nCVE-2026-98450, CVE-2026-98451, CVE-2026-98452, CVE-2026-98453,\nCVE-2026-98454, CVE-2026-98455, CVE-2026-98456, CVE-2026-98457,\nCVE-2026-98458, CVE-2026-98459, CVE-2026-98460, CVE-2026-98461,\nCVE-2026-98462, CVE-2026-98463, CVE-2026-98464, CVE-2026-98465,\nCVE-2026-98466, CVE-2026-98467, CVE-2026-98468, CVE-2026-98469,\nCVE-2026-98470, CVE-2026-98471, CVE-2026-98472, CVE-2026-98473,\nCVE-2026-98474, CVE-2026-98475, CVE-2026-98476, CVE-2026-98477,\nCVE-2026-98478, CVE-2026-98479, CVE-2026-98480, CVE-2026-98481,\nCVE-2026-98482, CVE-2026-98483, CVE-2026-98484, CVE-2026-98485,\nCVE-2026-98486, CVE-2026-98487, CVE-2026-98488, CVE-2026-98489,\nCVE-2026-98490, CVE-2026-98491, CVE-2026-98492, CVE-2026-98493,\nCVE-2026-98494, CVE-2026-98495, CVE-2026-98496, CVE-2026-98497,\nCVE-2026-98498, CVE-2026-98499, CVE-2026-98501, CVE-2026-98502,\nCVE-2026-98503, CVE-2026-98504, CVE-2026-98505, CVE-2026-98506,\nCVE-2026-98507, CVE-2026-98508, CVE-2026-98509, CVE-2026-98510,\nCVE-2026-98511, CVE-2026-98512, CVE-2026-98513, CVE-2026-98514,\nCVE-2026-98515, CVE-2026-98516, CVE-2026-98517, CVE-2026-98518,\nCVE-2026-98519, CVE-2026-98521, CVE-2026-98522, CVE-2026-98523,\nCVE-2026-98524, CVE-2026-98525, CVE-2026-98526, CVE-2026-98527,\nCVE-2026-98528, CVE-2026-98529, CVE-2026-98530, CVE-2026-98531,\nCVE-2026-98532, CVE-2026-98533, CVE-2026-98534, CVE-2026-98535,\nCVE-2026-98536, CVE-2026-98537, CVE-2026-98538, CVE-2026-98539,\nCVE-2026-98541, CVE-2026-98542, CVE-2026-98543, CVE-2026-98544,\nCVE-2026-98545, CVE-2026-98546, CVE-2026-98547, CVE-2026-98548,\nCVE-2026-98549, CVE-2026-98550, CVE-2026-98551, CVE-2026-98552,\nCVE-2026-98553, CVE-2026-98554, CVE-2026-98555, CVE-2026-98556,\nCVE-2026-98558, CVE-2026-98559, CVE-2026-98560, CVE-2026-98561,\nCVE-2026-98562, CVE-2026-98563, CVE-2026-98564, CVE-2026-98565,\nCVE-2026-98566, CVE-2026-98567, CVE-2026-98568, CVE-2026-98569,\nCVE-2026-98570, CVE-2026-98571, CVE-2026-98572, CVE-2026-98573,\nCVE-2026-98574, CVE-2026-98575, CVE-2026-98576, CVE-2026-98577,\nCVE-2026-98578, CVE-2026-98579, CVE-2026-98580, CVE-2026-98581,\nCVE-2026-98582, CVE-2026-98583, CVE-2026-98584, CVE-2026-98585,\nCVE-2026-98586, CVE-2026-98588, CVE-2026-98589, CVE-2026-98590,\nCVE-2026-98591, CVE-2026-98592, CVE-2026-98593, CVE-2026-98594,\nCVE-2026-98595, CVE-2026-98596, CVE-2026-98597, CVE-2026-98598,\nCVE-2026-98599, CVE-2026-98601, CVE-2026-98602, CVE-2026-98603,\nCVE-2026-98604, CVE-2026-98605, CVE-2026-98606, CVE-2026-98607,\nCVE-2026-98608, CVE-2026-98609, CVE-2026-98610, CVE-2026-98611,\nCVE-2026-98612, CVE-2026-98613, CVE-2026-98614, CVE-2026-98615,\nCVE-2026-98616, CVE-2026-98617, CVE-2026-98618, CVE-2026-98620,\nCVE-2026-98621, CVE-2026-98622, CVE-2026-98623, CVE-2026-98624,\nCVE-2026-98625, CVE-2026-98626, CVE-2026-98628, CVE-2026-98629,\nCVE-2026-98630, CVE-2026-98631, CVE-2026-98632, CVE-2026-98633,\nCVE-2026-98634, CVE-2026-98635, CVE-2026-98636, CVE-2026-98637,\nCVE-2026-98638, CVE-2026-98639, CVE-2026-98640, CVE-2026-98641,\nCVE-2026-98642, CVE-2026-98643, CVE-2026-98644, CVE-2026-98646,\nCVE-2026-98647, CVE-2026-98648, CVE-2026-98649, CVE-2026-98650,\nCVE-2026-98651, CVE-2026-98652, CVE-2026-98653, CVE-2026-98867,\nCVE-2026-98868, CVE-2026-98871, CVE-2026-98872, CVE-2026-98873,\nCVE-2026-98874, CVE-2026-98875, CVE-2026-98876, CVE-2026-98877,\nCVE-2026-98878, CVE-2026-98879, CVE-2026-98880, CVE-2026-98881,\nCVE-2026-98882, CVE-2026-98883, CVE-2026-98884, CVE-2026-98885,\nCVE-2026-98886, CVE-2026-98887, CVE-2026-98888, CVE-2026-98889,\nCVE-2026-98891, CVE-2026-98892, CVE-2026-98893, CVE-2026-98894,\nCVE-2026-98895, CVE-2026-98897, CVE-2026-98898, CVE-2026-98899,\nCVE-2026-98900, CVE-2026-98901, CVE-2026-98902, CVE-2026-98903,\nCVE-2026-98904, CVE-2026-98905, CVE-2026-98906, CVE-2026-98907,\nCVE-2026-98908, CVE-2026-98909, CVE-2026-98910, CVE-2026-98911,\nCVE-2026-98912, CVE-2026-98913, CVE-2026-98914, CVE-2026-98915,\nCVE-2026-98916, CVE-2026-98917, CVE-2026-98918, CVE-2026-98919,\nCVE-2026-98921, CVE-2026-98923, CVE-2026-98924, CVE-2026-98925,\nCVE-2026-98926, CVE-2026-98927, CVE-2026-98928, CVE-2026-98929,\nCVE-2026-98930)\n","status":"published","published":"2026-11-03T11:03:02Z","modified":"2026-11-09T12:49:43.015417372Z","updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"USN-8963-1","title":"linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx vulnerabilities","description":"Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol\nimplementation in the Linux kernel, leading to use-after-free\nvulnerabilities. A local attacker could possibly use this to cause a denial\nof service (system crash). (CVE-2022-1205)\n\nIt was discovered that the i.MX clock driver in the Linux kernel did not\nproperly handle certain memory allocation failure conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2022-3114)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - USB Gadget drivers;\n  - Networking core;\n  - User-space API (UAPI);\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - OpenRISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Speakup Console Speech Driver;\n  - ACPI drivers;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - Auxiliary display drivers;\n  - Drivers core;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Rados block device (RBD) driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Clocksource drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - DAX dirext access to differentiated memory framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - FireWire subsystem;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - ARM SCPI message protocol;\n  - Google firmware drivers;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - HSI subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - IIO ADC drivers;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Mouse) drivers;\n  - On-Chip Interconnect management framework;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MemoryStick subsystem;\n  - Multifunction device drivers;\n  - Analog Devices digital potentiometer driver;\n  - Broadcom VK accelerator driver;\n  - Fastrpc Driver;\n  - MMC subsystem;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - MediaTek network drivers;\n  - Near Field Communication (NFC) drivers;\n  - NTB driver;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - Device tree and open firmware driver;\n  - PA-RISC drivers;\n  - Parport drivers;\n  - PCI subsystem;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - Mellanox platform drivers;\n  - Microsoft Surface platform drivers;\n  - x86 platform drivers;\n  - Generic PM domains;\n  - System reset/shutdown drivers;\n  - Power supply drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - Reset controller framework;\n  - RPMSG subsystem;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Greybus lights staging drivers;\n  - Media staging drivers;\n  - Media Oriented Systems Transport (MOST) driver;\n  - NVIDIA Tegra embedded controller (NVEC) staging driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - USB DSL drivers;\n  - Cypress C67X00 USB driver;\n  - Cadence USB3 driver;\n  - USB Device Class drivers;\n  - ULPI bus;\n  - USB core drivers;\n  - DesignWare USB2 driver;\n  - DesignWare USB3 driver;\n  - USB Host Controller drivers;\n  - Mustek MDC800 USB digital camera driver;\n  - USB ChaosKey driver;\n  - Siemens ID Mouse USB driver;\n  - IOWarrior USB driver;\n  - LD Didactic USB driver;\n  - LEGO USB Tower driver;\n  - USS720 USB parallel port adapter driver;\n  - MediaTek USB3 DRD driver;\n  - USB Serial drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Port Controller Manager driver;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - vDPA drivers;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - W1 Dallas's 1-wire bus driver;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - 9P distributed file system;\n  - File systems infrastructure;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - eCrypt file system;\n  - EROFS file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FAT file system;\n  - FUSE (File system in Userspace);\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UBI file system;\n  - UDF file system;\n  - XFS file system;\n  - Key management;\n  - BPF subsystem;\n  - Software nodes and device properties;\n  - Glob pattern matching library;\n  - IPv4 networking;\n  - Internal shared memory driver;\n  - KVM subsystem;\n  - Netfilter;\n  - Scheduler infrastructure;\n  - Socket messages infrastructure;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Virtio network driver;\n  - Memory Management;\n  - Media input infrastructure;\n  - Network traffic control;\n  - IPv6 networking;\n  - Amateur Radio drivers;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - NFC subsystem;\n  - SCTP protocol;\n  - TCP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Audit subsystem;\n  - Control group (cgroup);\n  - Kernel CPU control infrastructure;\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel fork() syscall;\n  - Kernel futex primitives;\n  - KCOV code coverage framework;\n  - Locking primitives;\n  - RCU subsystem;\n  - Signal handling mechanism;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Workqueue subsystem;\n  - Kernel build system;\n  - Cryptographic library;\n  - Debug objects infrastructure;\n  - Resizable hashtable library;\n  - Heterogeneous memory management;\n  - UCS-2 string library;\n  - Memory management;\n  - 6LoWPAN network protocol;\n  - IEEE 802 network protocols;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Distributed Switch Architecture;\n  - Ethtool driver;\n  - HSR network protocol;\n  - IEEE802154.4 network protocol;\n  - IFE protocol;\n  - IUCV driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - IEEE 802.15.4 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NCSI (Network Controller Sideband Interface) driver;\n  - NetLabel subsystem;\n  - Open vSwitch;\n  - Packet sockets;\n  - Phonet protocol;\n  - Packet sampling (psample);\n  - Qualcomm IPC Router (QRTR);\n  - RDS protocol;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - X.25 network layer;\n  - AppArmor security module;\n  - Linux Security Modules (LSM) Framework;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Landlock security;\n  - SELinux security module;\n  - Simplified Mandatory Access Control Kernel framework;\n  - Apple Onboard Audio ALSA driver;\n  - ALSA framework;\n  - Generic PCM loopback sound driver;\n  - Generic sound devices;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - ESS ES18xx ALSA driver;\n  - ESS Solo-1 ALSA driver;\n  - Digigram PCXHR ALSA driver;\n  - Cirrus Logic audio codecs;\n  - QCOM ASoC drivers;\n  - Realtek audio codecs;\n  - Simple audio multiplexer codec driver;\n  - WCD audio codecs;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - Amlogic Meson SoC drivers;\n  - Rockchip ASoC drivers;\n  - SoC audio core drivers;\n  - Spreadtrum ASoC drivers;\n  - STI ASoC drivers;\n  - NVIDIA Tegra ASoC drivers;\n  - Xilinx ASoC drivers;\n  - USB sound devices;\n  - Perf tools;\n(CVE-2022-49234, CVE-2022-49359, CVE-2022-49562, CVE-2022-49651,\nCVE-2022-49858, CVE-2022-50071, CVE-2022-50303, CVE-2022-50406,\nCVE-2023-52676, CVE-2023-53231, CVE-2023-53320, CVE-2023-53707,\nCVE-2023-54125, CVE-2023-54271, CVE-2024-41062, CVE-2024-46754,\nCVE-2024-49568, CVE-2024-50017, CVE-2024-53187, CVE-2024-53210,\nCVE-2024-53220, CVE-2024-54683, CVE-2024-57945, CVE-2024-57982,\nCVE-2024-57999, CVE-2024-58094, CVE-2024-58095, CVE-2024-58096,\nCVE-2025-21649, CVE-2025-21651, CVE-2025-21759, CVE-2025-21801,\nCVE-2025-21812, CVE-2025-21947, CVE-2025-22026, CVE-2025-22039,\nCVE-2025-22057, CVE-2025-22083, CVE-2025-22103, CVE-2025-23131,\nCVE-2025-23160, CVE-2025-37861, CVE-2025-37920, CVE-2025-38069,\nCVE-2025-38097, CVE-2025-38239, CVE-2025-38259, CVE-2025-38349,\nCVE-2025-38361, CVE-2025-38615, CVE-2025-38643, CVE-2025-39726,\nCVE-2025-39779, CVE-2025-39810, CVE-2025-39863, CVE-2025-39925,\nCVE-2025-39929, CVE-2025-39931, CVE-2025-40054, CVE-2025-40102,\nCVE-2025-40123, CVE-2025-68190, CVE-2025-68794, CVE-2026-100070,\nCVE-2026-100075, CVE-2026-23191, CVE-2026-23364, CVE-2026-31420,\nCVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700,\nCVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,\nCVE-2026-31715, CVE-2026-43064, CVE-2026-43088, CVE-2026-43216,\nCVE-2026-43219, CVE-2026-43350, CVE-2026-43355, CVE-2026-43437,\nCVE-2026-43456, CVE-2026-43491, CVE-2026-43492, CVE-2026-45850,\nCVE-2026-45930, CVE-2026-45991, CVE-2026-45999, CVE-2026-46003,\nCVE-2026-46021, CVE-2026-46026, CVE-2026-46038, CVE-2026-46052,\nCVE-2026-46056, CVE-2026-46065, CVE-2026-46069, CVE-2026-46078,\nCVE-2026-46086, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092,\nCVE-2026-46103, CVE-2026-46113, CVE-2026-46116, CVE-2026-46158,\nCVE-2026-46159, CVE-2026-46160, CVE-2026-46169, CVE-2026-46170,\nCVE-2026-46180, CVE-2026-46191, CVE-2026-46193, CVE-2026-46196,\nCVE-2026-46208, CVE-2026-46242, CVE-2026-46252, CVE-2026-46291,\nCVE-2026-46292, CVE-2026-46299, CVE-2026-46320, CVE-2026-46321,\nCVE-2026-46322, CVE-2026-52909, CVE-2026-52910, CVE-2026-52913,\nCVE-2026-52917, CVE-2026-52918, CVE-2026-52923, CVE-2026-52927,\nCVE-2026-52928, CVE-2026-52929, CVE-2026-52930, CVE-2026-52933,\nCVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942,\nCVE-2026-52943, CVE-2026-52944, CVE-2026-52947, CVE-2026-52948,\nCVE-2026-52977, CVE-2026-52988, CVE-2026-53078, CVE-2026-53080,\nCVE-2026-53089, CVE-2026-53090, CVE-2026-53133, CVE-2026-53134,\nCVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138,\nCVE-2026-53139, CVE-2026-53146, CVE-2026-53148, CVE-2026-53149,\nCVE-2026-53150, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159,\nCVE-2026-53161, CVE-2026-53163, CVE-2026-53167, CVE-2026-53168,\nCVE-2026-53177, CVE-2026-53181, CVE-2026-53189, CVE-2026-53194,\nCVE-2026-53195, CVE-2026-53196, CVE-2026-53199, CVE-2026-53208,\nCVE-2026-53213, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219,\nCVE-2026-53223, CVE-2026-53227, CVE-2026-53238, CVE-2026-53239,\nCVE-2026-53245, CVE-2026-53249, CVE-2026-53252, CVE-2026-53253,\nCVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263,\nCVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53268,\nCVE-2026-53269, CVE-2026-53270, CVE-2026-53273, CVE-2026-53275,\nCVE-2026-53325, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332,\nCVE-2026-53337, CVE-2026-53339, CVE-2026-53352, CVE-2026-53356,\nCVE-2026-53357, CVE-2026-53358, CVE-2026-53381, CVE-2026-53382,\nCVE-2026-53383, CVE-2026-53385, CVE-2026-53388, CVE-2026-53391,\nCVE-2026-53392, CVE-2026-53393, CVE-2026-53397, CVE-2026-53399,\nCVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794,\nCVE-2026-63796, CVE-2026-63798, CVE-2026-63801, CVE-2026-63803,\nCVE-2026-63806, CVE-2026-63807, CVE-2026-63809, CVE-2026-63810,\nCVE-2026-63814, CVE-2026-63815, CVE-2026-63817, CVE-2026-63818,\nCVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63827,\nCVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831,\nCVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836,\nCVE-2026-63867, CVE-2026-63868, CVE-2026-63870, CVE-2026-63875,\nCVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892,\nCVE-2026-63893, CVE-2026-63895, CVE-2026-63897, CVE-2026-63898,\nCVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902,\nCVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908,\nCVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916,\nCVE-2026-63917, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921,\nCVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928,\nCVE-2026-63930, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934,\nCVE-2026-63942, CVE-2026-63947, CVE-2026-63948, CVE-2026-63954,\nCVE-2026-63956, CVE-2026-63957, CVE-2026-63960, CVE-2026-63961,\nCVE-2026-63964, CVE-2026-63967, CVE-2026-63971, CVE-2026-63975,\nCVE-2026-63976, CVE-2026-63985, CVE-2026-63990, CVE-2026-63991,\nCVE-2026-64002, CVE-2026-64004, CVE-2026-64005, CVE-2026-64009,\nCVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64014,\nCVE-2026-64048, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094,\nCVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123,\nCVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187,\nCVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192,\nCVE-2026-64206, CVE-2026-64222, CVE-2026-64225, CVE-2026-64234,\nCVE-2026-64237, CVE-2026-64242, CVE-2026-64243, CVE-2026-64246,\nCVE-2026-64249, CVE-2026-64266, CVE-2026-64268, CVE-2026-64269,\nCVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273,\nCVE-2026-64274, CVE-2026-64275, CVE-2026-64276, CVE-2026-64277,\nCVE-2026-64279, CVE-2026-64280, CVE-2026-64294, CVE-2026-64296,\nCVE-2026-64298, CVE-2026-64299, CVE-2026-64301, CVE-2026-64303,\nCVE-2026-64304, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313,\nCVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318,\nCVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64329,\nCVE-2026-64330, CVE-2026-64331, CVE-2026-64332, CVE-2026-64333,\nCVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337,\nCVE-2026-64338, CVE-2026-64340, CVE-2026-64342, CVE-2026-64343,\nCVE-2026-64344, CVE-2026-64346, CVE-2026-64347, CVE-2026-64350,\nCVE-2026-64351, CVE-2026-64352, CVE-2026-64355, CVE-2026-64359,\nCVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363,\nCVE-2026-64364, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372,\nCVE-2026-64373, CVE-2026-64374, CVE-2026-64375, CVE-2026-64379,\nCVE-2026-64380, CVE-2026-64381, CVE-2026-64390, CVE-2026-64401,\nCVE-2026-64403, CVE-2026-64408, CVE-2026-64411, CVE-2026-64412,\nCVE-2026-64413, CVE-2026-64420, CVE-2026-64422, CVE-2026-64423,\nCVE-2026-64425, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430,\nCVE-2026-64432, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438,\nCVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443,\nCVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64448,\nCVE-2026-64450, CVE-2026-64452, CVE-2026-64454, CVE-2026-64455,\nCVE-2026-64456, CVE-2026-64461, CVE-2026-64462, CVE-2026-64465,\nCVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471,\nCVE-2026-64475, CVE-2026-64478, CVE-2026-64483, CVE-2026-64484,\nCVE-2026-64487, CVE-2026-64488, CVE-2026-64494, CVE-2026-64495,\nCVE-2026-64496, CVE-2026-64497, CVE-2026-64500, CVE-2026-64503,\nCVE-2026-64504, CVE-2026-64505, CVE-2026-64510, CVE-2026-64512,\nCVE-2026-64514, CVE-2026-64524, CVE-2026-64527, CVE-2026-64528,\nCVE-2026-64529, CVE-2026-64530, CVE-2026-64532, CVE-2026-64533,\nCVE-2026-64534, CVE-2026-64535, CVE-2026-64536, CVE-2026-64537,\nCVE-2026-64538, CVE-2026-64540, CVE-2026-64541, CVE-2026-64543,\nCVE-2026-64544, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547,\nCVE-2026-64548, CVE-2026-64549, CVE-2026-64550, CVE-2026-64551,\nCVE-2026-64553, CVE-2026-64554, CVE-2026-64560, CVE-2026-64561,\nCVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64565,\nCVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572,\nCVE-2026-64573, CVE-2026-64576, CVE-2026-64578, CVE-2026-64579,\nCVE-2026-64581, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584,\nCVE-2026-64585, CVE-2026-64586, CVE-2026-64590, CVE-2026-64593,\nCVE-2026-64594, CVE-2026-64599, CVE-2026-64600, CVE-2026-64602,\nCVE-2026-64604, CVE-2026-68082, CVE-2026-68088, CVE-2026-68090,\nCVE-2026-68091, CVE-2026-68096, CVE-2026-68104, CVE-2026-68106,\nCVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121,\nCVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129,\nCVE-2026-68130, CVE-2026-68131, CVE-2026-68132, CVE-2026-68135,\nCVE-2026-68137, CVE-2026-68138, CVE-2026-68140, CVE-2026-68141,\nCVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68146,\nCVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155,\nCVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68159,\nCVE-2026-68160, CVE-2026-68162, CVE-2026-68175, CVE-2026-68176,\nCVE-2026-68180, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184,\nCVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68190,\nCVE-2026-68192, CVE-2026-68195, CVE-2026-68196, CVE-2026-68197,\nCVE-2026-68198, CVE-2026-68199, CVE-2026-68202, CVE-2026-68204,\nCVE-2026-68205, CVE-2026-68209, CVE-2026-68212, CVE-2026-68213,\nCVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217,\nCVE-2026-68218, CVE-2026-68222, CVE-2026-68223, CVE-2026-68226,\nCVE-2026-68227, CVE-2026-68229, CVE-2026-68231, CVE-2026-68234,\nCVE-2026-68236, CVE-2026-68243, CVE-2026-68244, CVE-2026-68248,\nCVE-2026-68249, CVE-2026-68250, CVE-2026-68253, CVE-2026-68254,\nCVE-2026-68255, CVE-2026-68277, CVE-2026-68278, CVE-2026-68279,\nCVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,\nCVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309,\nCVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,\nCVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327,\nCVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335,\nCVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,\nCVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354,\nCVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361,\nCVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68367,\nCVE-2026-68368, CVE-2026-68369, CVE-2026-68370, CVE-2026-68373,\nCVE-2026-68376, CVE-2026-68377, CVE-2026-68388, CVE-2026-68395,\nCVE-2026-68397, CVE-2026-68398, CVE-2026-68399, CVE-2026-68402,\nCVE-2026-68403, CVE-2026-68405, CVE-2026-68406, CVE-2026-68410,\nCVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68417,\nCVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68430,\nCVE-2026-68431, CVE-2026-68432, CVE-2026-68433, CVE-2026-68444,\nCVE-2026-68446, CVE-2026-68449, CVE-2026-68450, CVE-2026-68451,\nCVE-2026-68452, CVE-2026-68456, CVE-2026-68459, CVE-2026-68460,\nCVE-2026-68461, CVE-2026-68466, CVE-2026-68467, CVE-2026-68469,\nCVE-2026-68474, CVE-2026-68475, CVE-2026-68476, CVE-2026-68477,\nCVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004,\nCVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,\nCVE-2026-72015, CVE-2026-72019, CVE-2026-72020, CVE-2026-72021,\nCVE-2026-72022, CVE-2026-72023, CVE-2026-72024, CVE-2026-72025,\nCVE-2026-72033, CVE-2026-72035, CVE-2026-72036, CVE-2026-72038,\nCVE-2026-72039, CVE-2026-72041, CVE-2026-72045, CVE-2026-72047,\nCVE-2026-72048, CVE-2026-72049, CVE-2026-72051, CVE-2026-72052,\nCVE-2026-72053, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056,\nCVE-2026-72057, CVE-2026-72058, CVE-2026-72061, CVE-2026-72063,\nCVE-2026-72065, CVE-2026-72066, CVE-2026-72067, CVE-2026-72068,\nCVE-2026-72069, CVE-2026-72070, CVE-2026-72073, CVE-2026-72074,\nCVE-2026-72076, CVE-2026-72077, CVE-2026-72078, CVE-2026-72079,\nCVE-2026-72081, CVE-2026-72082, CVE-2026-72083, CVE-2026-72084,\nCVE-2026-72085, CVE-2026-72086, CVE-2026-72087, CVE-2026-72088,\nCVE-2026-72096, CVE-2026-72099, CVE-2026-72102, CVE-2026-72105,\nCVE-2026-72107, CVE-2026-72108, CVE-2026-72109, CVE-2026-72110,\nCVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116,\nCVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120,\nCVE-2026-72121, CVE-2026-72122, CVE-2026-72123, CVE-2026-72124,\nCVE-2026-72125, CVE-2026-72126, CVE-2026-72129, CVE-2026-72133,\nCVE-2026-72135, CVE-2026-72136, CVE-2026-72138, CVE-2026-72140,\nCVE-2026-72142, CVE-2026-72146, CVE-2026-72148, CVE-2026-72152,\nCVE-2026-72153, CVE-2026-72155, CVE-2026-72157, CVE-2026-72159,\nCVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165,\nCVE-2026-72166, CVE-2026-72167, CVE-2026-72170, CVE-2026-72171,\nCVE-2026-72181, CVE-2026-72182, CVE-2026-72191, CVE-2026-72192,\nCVE-2026-72193, CVE-2026-72194, CVE-2026-72195, CVE-2026-72197,\nCVE-2026-72215, CVE-2026-72216, CVE-2026-72218, CVE-2026-72219,\nCVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72226,\nCVE-2026-72228, CVE-2026-72229, CVE-2026-72230, CVE-2026-72231,\nCVE-2026-72232, CVE-2026-72233, CVE-2026-72234, CVE-2026-72235,\nCVE-2026-72238, CVE-2026-72240, CVE-2026-72241, CVE-2026-72242,\nCVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251,\nCVE-2026-72252, CVE-2026-72253, CVE-2026-72255, CVE-2026-72256,\nCVE-2026-72260, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267,\nCVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271,\nCVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276,\nCVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297,\nCVE-2026-72298, CVE-2026-72299, CVE-2026-72305, CVE-2026-72306,\nCVE-2026-72307, CVE-2026-72308, CVE-2026-72310, CVE-2026-72314,\nCVE-2026-72316, CVE-2026-72319, CVE-2026-72322, CVE-2026-72323,\nCVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348,\nCVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371,\nCVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392,\nCVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409,\nCVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422,\nCVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441,\nCVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459,\nCVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479,\nCVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489,\nCVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255,\nCVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267,\nCVE-2026-74268, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280,\nCVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284,\nCVE-2026-74287, CVE-2026-74288, CVE-2026-74292, CVE-2026-74293,\nCVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312,\nCVE-2026-74313, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327,\nCVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339,\nCVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349,\nCVE-2026-74351, CVE-2026-74359, CVE-2026-74363, CVE-2026-74376,\nCVE-2026-74378, CVE-2026-74379, CVE-2026-74382, CVE-2026-74384,\nCVE-2026-74390, CVE-2026-74394, CVE-2026-74395, CVE-2026-74398,\nCVE-2026-74399, CVE-2026-74402, CVE-2026-74408, CVE-2026-74410,\nCVE-2026-74416, CVE-2026-74424, CVE-2026-74426, CVE-2026-74427,\nCVE-2026-74436, CVE-2026-74438, CVE-2026-74443, CVE-2026-74444,\nCVE-2026-74453, CVE-2026-74455, CVE-2026-74456, CVE-2026-74457,\nCVE-2026-74458, CVE-2026-74459, CVE-2026-74460, CVE-2026-74461,\nCVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74467,\nCVE-2026-74468, CVE-2026-74469, CVE-2026-74470, CVE-2026-74471,\nCVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74479,\nCVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485,\nCVE-2026-74487, CVE-2026-74488, CVE-2026-74490, CVE-2026-74492,\nCVE-2026-74493, CVE-2026-74494, CVE-2026-74495, CVE-2026-74496,\nCVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505,\nCVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518,\nCVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540,\nCVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549,\nCVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564,\nCVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74575,\nCVE-2026-74577, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580,\nCVE-2026-74581, CVE-2026-74582, CVE-2026-74583, CVE-2026-74584,\nCVE-2026-74585, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588,\nCVE-2026-74589, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597,\nCVE-2026-74598, CVE-2026-74599, CVE-2026-74601, CVE-2026-74604,\nCVE-2026-74609, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615,\nCVE-2026-74616, CVE-2026-74620, CVE-2026-74621, CVE-2026-74622,\nCVE-2026-74623, CVE-2026-74625, CVE-2026-74626, CVE-2026-74628,\nCVE-2026-74630, CVE-2026-74631, CVE-2026-74632, CVE-2026-74635,\nCVE-2026-74636, CVE-2026-74637, CVE-2026-74641, CVE-2026-74647,\nCVE-2026-74648, CVE-2026-74649, CVE-2026-74650, CVE-2026-74651,\nCVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658,\nCVE-2026-74659, CVE-2026-74660, CVE-2026-74662, CVE-2026-74663,\nCVE-2026-74664, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668,\nCVE-2026-74669, CVE-2026-74671, CVE-2026-74673, CVE-2026-74675,\nCVE-2026-74676, CVE-2026-74679, CVE-2026-74680, CVE-2026-74682,\nCVE-2026-74683, CVE-2026-74688, CVE-2026-74691, CVE-2026-74692,\nCVE-2026-74693, CVE-2026-74694, CVE-2026-74696, CVE-2026-74697,\nCVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74717,\nCVE-2026-74719, CVE-2026-74720, CVE-2026-74726, CVE-2026-74730,\nCVE-2026-74737, CVE-2026-74743, CVE-2026-74746, CVE-2026-74748,\nCVE-2026-80527, CVE-2026-80528, CVE-2026-80534, CVE-2026-80536,\nCVE-2026-80540, CVE-2026-80541, CVE-2026-80547, CVE-2026-80548,\nCVE-2026-80550, CVE-2026-80552, CVE-2026-80553, CVE-2026-80555,\nCVE-2026-80557, CVE-2026-80558, CVE-2026-80559, CVE-2026-80560,\nCVE-2026-80561, CVE-2026-80562, CVE-2026-80565, CVE-2026-80567,\nCVE-2026-80568, CVE-2026-80569, CVE-2026-80570, CVE-2026-80573,\nCVE-2026-80574, CVE-2026-80583, CVE-2026-80584, CVE-2026-80586,\nCVE-2026-80587, CVE-2026-80590, CVE-2026-80591, CVE-2026-80593,\nCVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598,\nCVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603,\nCVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619,\nCVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630,\nCVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647,\nCVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664,\nCVE-2026-80671, CVE-2026-80677, CVE-2026-80678, CVE-2026-80679,\nCVE-2026-80680, CVE-2026-80681, CVE-2026-80689, CVE-2026-80706,\nCVE-2026-80707, CVE-2026-80708, CVE-2026-80714, CVE-2026-80715,\nCVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722,\nCVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80737,\nCVE-2026-80742, CVE-2026-80743, CVE-2026-80744, CVE-2026-80752,\nCVE-2026-80754, CVE-2026-80756, CVE-2026-80757, CVE-2026-80765,\nCVE-2026-80766, CVE-2026-80767, CVE-2026-80768, CVE-2026-80781,\nCVE-2026-80782, CVE-2026-80783, CVE-2026-80788, CVE-2026-80789,\nCVE-2026-80790, CVE-2026-80792, CVE-2026-80793, CVE-2026-80794,\nCVE-2026-80795, CVE-2026-80796, CVE-2026-80797, CVE-2026-80798,\nCVE-2026-80799, CVE-2026-80800, CVE-2026-80801, CVE-2026-80802,\nCVE-2026-80803, CVE-2026-80805, CVE-2026-80806, CVE-2026-80807,\nCVE-2026-80808, CVE-2026-80809, CVE-2026-80812, CVE-2026-80814,\nCVE-2026-80819, CVE-2026-80823, CVE-2026-80824, CVE-2026-80826,\nCVE-2026-80827, CVE-2026-80828, CVE-2026-80829, CVE-2026-80830,\nCVE-2026-80831, CVE-2026-80832, CVE-2026-80833, CVE-2026-80834,\nCVE-2026-80840, CVE-2026-80842, CVE-2026-80843, CVE-2026-80844,\nCVE-2026-80846, CVE-2026-80848, CVE-2026-80854, CVE-2026-80855,\nCVE-2026-80856, CVE-2026-80863, CVE-2026-80867, CVE-2026-80875,\nCVE-2026-80876, CVE-2026-80877, CVE-2026-80879, CVE-2026-80880,\nCVE-2026-80881, CVE-2026-80886, CVE-2026-80888, CVE-2026-80890,\nCVE-2026-80902, CVE-2026-80906, CVE-2026-80908, CVE-2026-80909,\nCVE-2026-80910, CVE-2026-80912, CVE-2026-80913, CVE-2026-80916,\nCVE-2026-80917, CVE-2026-80918, CVE-2026-80921, CVE-2026-80923,\nCVE-2026-80928, CVE-2026-80930, CVE-2026-80931, CVE-2026-80932,\nCVE-2026-80938, CVE-2026-80941, CVE-2026-80944, CVE-2026-80949,\nCVE-2026-80951, CVE-2026-80952, CVE-2026-80963, CVE-2026-80964,\nCVE-2026-80965, CVE-2026-80966, CVE-2026-80967, CVE-2026-80968,\nCVE-2026-80969, CVE-2026-80971, CVE-2026-80972, CVE-2026-80973,\nCVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80983,\nCVE-2026-80987, CVE-2026-80988, CVE-2026-80994, CVE-2026-81000,\nCVE-2026-81001, CVE-2026-81002, CVE-2026-81003, CVE-2026-81005,\nCVE-2026-81007, CVE-2026-81008, CVE-2026-81017, CVE-2026-89440,\nCVE-2026-89444, CVE-2026-89456, CVE-2026-89457, CVE-2026-89458,\nCVE-2026-89461, CVE-2026-89463, CVE-2026-89464, CVE-2026-89469,\nCVE-2026-89470, CVE-2026-89471, CVE-2026-89474, CVE-2026-89475,\nCVE-2026-89476, CVE-2026-89477, CVE-2026-89478, CVE-2026-89479,\nCVE-2026-89480, CVE-2026-89482, CVE-2026-89483, CVE-2026-89485,\nCVE-2026-89487, CVE-2026-89488, CVE-2026-89489, CVE-2026-89490,\nCVE-2026-89491, CVE-2026-89493, CVE-2026-89494, CVE-2026-89495,\nCVE-2026-89496, CVE-2026-89497, CVE-2026-89498, CVE-2026-89504,\nCVE-2026-89508, CVE-2026-89510, CVE-2026-89511, CVE-2026-89512,\nCVE-2026-89515, CVE-2026-89524, CVE-2026-89525, CVE-2026-89532,\nCVE-2026-89533, CVE-2026-89538, CVE-2026-89540, CVE-2026-89541,\nCVE-2026-89542, CVE-2026-89548, CVE-2026-89549, CVE-2026-89551,\nCVE-2026-89554, CVE-2026-89555, CVE-2026-89557, CVE-2026-89559,\nCVE-2026-89560, CVE-2026-89562, CVE-2026-89563, CVE-2026-89569,\nCVE-2026-89573, CVE-2026-89575, CVE-2026-89576, CVE-2026-89582,\nCVE-2026-89585, CVE-2026-89586, CVE-2026-89594, CVE-2026-89595,\nCVE-2026-89596, CVE-2026-89597, CVE-2026-89599, CVE-2026-89605,\nCVE-2026-89606, CVE-2026-89607, CVE-2026-89608, CVE-2026-89609,\nCVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89621,\nCVE-2026-89626, CVE-2026-89627, CVE-2026-89628, CVE-2026-89643,\nCVE-2026-89649, CVE-2026-89650, CVE-2026-89653, CVE-2026-89655,\nCVE-2026-89656, CVE-2026-89662, CVE-2026-89663, CVE-2026-89665,\nCVE-2026-89669, CVE-2026-89673, CVE-2026-89674, CVE-2026-89684,\nCVE-2026-89694, CVE-2026-89696, CVE-2026-89697, CVE-2026-89699,\nCVE-2026-89704, CVE-2026-89706, CVE-2026-89710, CVE-2026-89711,\nCVE-2026-89712, CVE-2026-89720, CVE-2026-89723, CVE-2026-89724,\nCVE-2026-89725, CVE-2026-89726, CVE-2026-89729, CVE-2026-89730,\nCVE-2026-89732, CVE-2026-89733, CVE-2026-89736, CVE-2026-89741,\nCVE-2026-89742, CVE-2026-89749, CVE-2026-89752, CVE-2026-89753,\nCVE-2026-89765, CVE-2026-89774, CVE-2026-89777, CVE-2026-89778,\nCVE-2026-89779, CVE-2026-89780, CVE-2026-89781, CVE-2026-89782,\nCVE-2026-89783, CVE-2026-89784, CVE-2026-89785, CVE-2026-89786,\nCVE-2026-89787, CVE-2026-89789, CVE-2026-89792, CVE-2026-89796,\nCVE-2026-89816, CVE-2026-89817, CVE-2026-89821, CVE-2026-89823,\nCVE-2026-89843, CVE-2026-89845, CVE-2026-89846, CVE-2026-89847,\nCVE-2026-89849, CVE-2026-89850, CVE-2026-89851, CVE-2026-89852,\nCVE-2026-89853, CVE-2026-89854, CVE-2026-89855, CVE-2026-89856,\nCVE-2026-89858, CVE-2026-89861, CVE-2026-89863, CVE-2026-89864,\nCVE-2026-89865, CVE-2026-89871, CVE-2026-89872, CVE-2026-89876,\nCVE-2026-89878, CVE-2026-89879, CVE-2026-89880, CVE-2026-89881,\nCVE-2026-89883, CVE-2026-89887, CVE-2026-89888, CVE-2026-89890,\nCVE-2026-89891, CVE-2026-89892, CVE-2026-89893, CVE-2026-89894,\nCVE-2026-89895, CVE-2026-89896, CVE-2026-89897, CVE-2026-89901,\nCVE-2026-89923, CVE-2026-89924, CVE-2026-89925, CVE-2026-89926,\nCVE-2026-89927, CVE-2026-89930, CVE-2026-89932, CVE-2026-89936,\nCVE-2026-89937, CVE-2026-89939, CVE-2026-89945, CVE-2026-89946,\nCVE-2026-89947, CVE-2026-89948, CVE-2026-89949, CVE-2026-89951,\nCVE-2026-89952, CVE-2026-89953, CVE-2026-89954, CVE-2026-89964,\nCVE-2026-89965, CVE-2026-89968, CVE-2026-89969, CVE-2026-89973,\nCVE-2026-89979, CVE-2026-89982, CVE-2026-89983, CVE-2026-89984,\nCVE-2026-89989, CVE-2026-89993, CVE-2026-89997, CVE-2026-89999,\nCVE-2026-90000, CVE-2026-90007, CVE-2026-90011, CVE-2026-90015,\nCVE-2026-90017, CVE-2026-90018, CVE-2026-90019, CVE-2026-90020,\nCVE-2026-90025, CVE-2026-90031, CVE-2026-90032, CVE-2026-90033,\nCVE-2026-90034, CVE-2026-90049, CVE-2026-90053, CVE-2026-90054,\nCVE-2026-90055, CVE-2026-90056, CVE-2026-90058, CVE-2026-90062,\nCVE-2026-90063, CVE-2026-90067, CVE-2026-90068, CVE-2026-90070,\nCVE-2026-90071, CVE-2026-90072, CVE-2026-90073, CVE-2026-90074,\nCVE-2026-90075, CVE-2026-90078, CVE-2026-90081, CVE-2026-90088,\nCVE-2026-90102, CVE-2026-90103, CVE-2026-90107, CVE-2026-90114,\nCVE-2026-90126, CVE-2026-90128, CVE-2026-90140, CVE-2026-90141,\nCVE-2026-90143, CVE-2026-90151, CVE-2026-90157, CVE-2026-90160,\nCVE-2026-90198, CVE-2026-90202, CVE-2026-90203, CVE-2026-90209,\nCVE-2026-90214, CVE-2026-90216, CVE-2026-90218, CVE-2026-90219,\nCVE-2026-90221, CVE-2026-90222, CVE-2026-90223, CVE-2026-90224,\nCVE-2026-90225, CVE-2026-90226, CVE-2026-90228, CVE-2026-90245,\nCVE-2026-90248, CVE-2026-90249, CVE-2026-90251, CVE-2026-90257,\nCVE-2026-90274, CVE-2026-90281, CVE-2026-90283, CVE-2026-90284,\nCVE-2026-90285, CVE-2026-90286, CVE-2026-90290, CVE-2026-90292,\nCVE-2026-90293, CVE-2026-90294, CVE-2026-90295, CVE-2026-90296,\nCVE-2026-90297, CVE-2026-90298, CVE-2026-90302, CVE-2026-90303,\nCVE-2026-90307, CVE-2026-90314, CVE-2026-90316, CVE-2026-90318,\nCVE-2026-90319, CVE-2026-90327, CVE-2026-90329, CVE-2026-90334,\nCVE-2026-90341, CVE-2026-90348, CVE-2026-90360, CVE-2026-90361,\nCVE-2026-90362, CVE-2026-90372, CVE-2026-90378, CVE-2026-90382,\nCVE-2026-90386, CVE-2026-90388, CVE-2026-90391, CVE-2026-90393,\nCVE-2026-90394, CVE-2026-90395, CVE-2026-90403, CVE-2026-90411,\nCVE-2026-90413, CVE-2026-90414, CVE-2026-90415, CVE-2026-90416,\nCVE-2026-90419, CVE-2026-90420, CVE-2026-90431, CVE-2026-90434,\nCVE-2026-90435, CVE-2026-92476, CVE-2026-92494, CVE-2026-92496,\nCVE-2026-92498, CVE-2026-92501, CVE-2026-92504, CVE-2026-92508,\nCVE-2026-92521, CVE-2026-92522, CVE-2026-92524, CVE-2026-93037,\nCVE-2026-93039, CVE-2026-93040, CVE-2026-93041, CVE-2026-93046,\nCVE-2026-93048, CVE-2026-93049, CVE-2026-93051, CVE-2026-93052,\nCVE-2026-93053, CVE-2026-93054, CVE-2026-93055, CVE-2026-93056,\nCVE-2026-93061, CVE-2026-93067, CVE-2026-93095, CVE-2026-93098,\nCVE-2026-93102, CVE-2026-93103, CVE-2026-93108, CVE-2026-93109,\nCVE-2026-93110, CVE-2026-93114, CVE-2026-93115, CVE-2026-93120,\nCVE-2026-93130, CVE-2026-93131, CVE-2026-93138, CVE-2026-93140,\nCVE-2026-93141, CVE-2026-93145, CVE-2026-93151, CVE-2026-93158,\nCVE-2026-93159, CVE-2026-93160, CVE-2026-93161, CVE-2026-93165,\nCVE-2026-93167, CVE-2026-93170, CVE-2026-93177, CVE-2026-93178,\nCVE-2026-93183, CVE-2026-93185, CVE-2026-93188, CVE-2026-93189,\nCVE-2026-93191, CVE-2026-93203, CVE-2026-93204, CVE-2026-93206,\nCVE-2026-93213, CVE-2026-93214, CVE-2026-93219, CVE-2026-93222,\nCVE-2026-93226, CVE-2026-93234, CVE-2026-93236, CVE-2026-93242,\nCVE-2026-93245, CVE-2026-93252, CVE-2026-93256, CVE-2026-93261,\nCVE-2026-93262, CVE-2026-93264, CVE-2026-93268, CVE-2026-93271,\nCVE-2026-93274, CVE-2026-93280, CVE-2026-93283, CVE-2026-93286,\nCVE-2026-93287, CVE-2026-93288, CVE-2026-93782, CVE-2026-93783,\nCVE-2026-93784, CVE-2026-93785, CVE-2026-93789, CVE-2026-93795,\nCVE-2026-93797, CVE-2026-93798, CVE-2026-93800, CVE-2026-93802,\nCVE-2026-93803, CVE-2026-93805, CVE-2026-93807, CVE-2026-93808,\nCVE-2026-93811, CVE-2026-93812, CVE-2026-93813, CVE-2026-93815,\nCVE-2026-93816, CVE-2026-93819, CVE-2026-93820, CVE-2026-93821,\nCVE-2026-93822, CVE-2026-93825, CVE-2026-93830, CVE-2026-97407,\nCVE-2026-97408, CVE-2026-97411, CVE-2026-97413, CVE-2026-97416,\nCVE-2026-97417, CVE-2026-97418, CVE-2026-97419, CVE-2026-97420,\nCVE-2026-97421, CVE-2026-97430, CVE-2026-97434, CVE-2026-97435,\nCVE-2026-97436, CVE-2026-97437, CVE-2026-97438, CVE-2026-97439,\nCVE-2026-97440, CVE-2026-97441, CVE-2026-97443, CVE-2026-97444,\nCVE-2026-97445, CVE-2026-97446, CVE-2026-97448, CVE-2026-97449,\nCVE-2026-97450, CVE-2026-97451, CVE-2026-97452, CVE-2026-97453,\nCVE-2026-97454, CVE-2026-97455, CVE-2026-97456, CVE-2026-97472,\nCVE-2026-97475, CVE-2026-97476, CVE-2026-97481, CVE-2026-97482,\nCVE-2026-97483, CVE-2026-97484, CVE-2026-97485, CVE-2026-97486,\nCVE-2026-97487, CVE-2026-97488, CVE-2026-97489, CVE-2026-97490,\nCVE-2026-97491, CVE-2026-97492, CVE-2026-97502, CVE-2026-97506,\nCVE-2026-97507, CVE-2026-97508, CVE-2026-97509, CVE-2026-97510,\nCVE-2026-97523, CVE-2026-97524, CVE-2026-97568, CVE-2026-97572,\nCVE-2026-97573, CVE-2026-97576, CVE-2026-97582, CVE-2026-97592,\nCVE-2026-97596, CVE-2026-97598, CVE-2026-97601, CVE-2026-97604,\nCVE-2026-97608, CVE-2026-97611, CVE-2026-97612, CVE-2026-97899,\nCVE-2026-97904, CVE-2026-97905, CVE-2026-97909, CVE-2026-97910,\nCVE-2026-97923, CVE-2026-97926, CVE-2026-97927, CVE-2026-97930,\nCVE-2026-97931, CVE-2026-97940, CVE-2026-97948, CVE-2026-97951,\nCVE-2026-97954, CVE-2026-97957, CVE-2026-97958, CVE-2026-97959,\nCVE-2026-97963, CVE-2026-97964, CVE-2026-97969, CVE-2026-97970,\nCVE-2026-97981, CVE-2026-97982, CVE-2026-97991, CVE-2026-97993,\nCVE-2026-97995, CVE-2026-97998, CVE-2026-98006, CVE-2026-98009,\nCVE-2026-98010, CVE-2026-98011, CVE-2026-98012, CVE-2026-98013,\nCVE-2026-98014, CVE-2026-98015, CVE-2026-98016, CVE-2026-98022,\nCVE-2026-98023, CVE-2026-98025, CVE-2026-98027, CVE-2026-98030,\nCVE-2026-98031, CVE-2026-98063, CVE-2026-98064, CVE-2026-98066,\nCVE-2026-98068, CVE-2026-98069, CVE-2026-98070, CVE-2026-98071,\nCVE-2026-98072, CVE-2026-98074, CVE-2026-98075, CVE-2026-98076,\nCVE-2026-98077, CVE-2026-98078, CVE-2026-98080, CVE-2026-98088,\nCVE-2026-98090, CVE-2026-98091, CVE-2026-98094, CVE-2026-98095,\nCVE-2026-98096, CVE-2026-98098, CVE-2026-98108, CVE-2026-98113,\nCVE-2026-98116, CVE-2026-98121, CVE-2026-98123, CVE-2026-98130,\nCVE-2026-98154, CVE-2026-98157, CVE-2026-98158, CVE-2026-98160,\nCVE-2026-98181, CVE-2026-98185, CVE-2026-98186, CVE-2026-98187,\nCVE-2026-98188, CVE-2026-98189, CVE-2026-98190, CVE-2026-98191,\nCVE-2026-98194, CVE-2026-98195, CVE-2026-98196, CVE-2026-98197,\nCVE-2026-98199, CVE-2026-98201, CVE-2026-98202, CVE-2026-98203,\nCVE-2026-98204, CVE-2026-98205, CVE-2026-98207, CVE-2026-98208,\nCVE-2026-98209, CVE-2026-98210, CVE-2026-98217, CVE-2026-98221,\nCVE-2026-98233, CVE-2026-98234, CVE-2026-98236, CVE-2026-98237,\nCVE-2026-98241, CVE-2026-98251, CVE-2026-98252, CVE-2026-98253,\nCVE-2026-98255, CVE-2026-98257, CVE-2026-98262, CVE-2026-98272,\nCVE-2026-98275, CVE-2026-98276, CVE-2026-98282, CVE-2026-98287,\nCVE-2026-98290, CVE-2026-98298, CVE-2026-98299, CVE-2026-98300,\nCVE-2026-98302, CVE-2026-98306, CVE-2026-98308, CVE-2026-98311,\nCVE-2026-98314, CVE-2026-98319, CVE-2026-98320, CVE-2026-98322,\nCVE-2026-98323, CVE-2026-98339, CVE-2026-98340, CVE-2026-98342,\nCVE-2026-98343, CVE-2026-98344, CVE-2026-98345, CVE-2026-98347,\nCVE-2026-98348, CVE-2026-98349, CVE-2026-98351, CVE-2026-98352,\nCVE-2026-98354, CVE-2026-98357, CVE-2026-98358, CVE-2026-98362,\nCVE-2026-98363, CVE-2026-98367, CVE-2026-98369, CVE-2026-98370,\nCVE-2026-98374, CVE-2026-98379, CVE-2026-98380, CVE-2026-98381,\nCVE-2026-98383, CVE-2026-98398, CVE-2026-98404, CVE-2026-98406,\nCVE-2026-98407, CVE-2026-98413, CVE-2026-98416, CVE-2026-98417,\nCVE-2026-98419, CVE-2026-98422, CVE-2026-98426, CVE-2026-98433,\nCVE-2026-98455, CVE-2026-98457, CVE-2026-98460, CVE-2026-98461,\nCVE-2026-98476, CVE-2026-98479, CVE-2026-98481, CVE-2026-98482,\nCVE-2026-98483, CVE-2026-98485, CVE-2026-98488, CVE-2026-98489,\nCVE-2026-98491, CVE-2026-98494, CVE-2026-98495, CVE-2026-98498,\nCVE-2026-98499, CVE-2026-98501, CVE-2026-98511, CVE-2026-98514,\nCVE-2026-98515, CVE-2026-98516, CVE-2026-98524, CVE-2026-98526,\nCVE-2026-98527, CVE-2026-98529, CVE-2026-98531, CVE-2026-98532,\nCVE-2026-98535, CVE-2026-98536, CVE-2026-98537, CVE-2026-98541,\nCVE-2026-98547, CVE-2026-98548, CVE-2026-98550, CVE-2026-98553,\nCVE-2026-98554, CVE-2026-98555, CVE-2026-98559, CVE-2026-98567,\nCVE-2026-98569, CVE-2026-98573, CVE-2026-98575, CVE-2026-98576,\nCVE-2026-98577, CVE-2026-98578, CVE-2026-98579, CVE-2026-98580,\nCVE-2026-98581, CVE-2026-98582, CVE-2026-98583, CVE-2026-98586,\nCVE-2026-98588, CVE-2026-98590, CVE-2026-98593, CVE-2026-98594,\nCVE-2026-98597, CVE-2026-98602, CVE-2026-98606, CVE-2026-98607,\nCVE-2026-98608, CVE-2026-98609, CVE-2026-98610, CVE-2026-98612,\nCVE-2026-98614, CVE-2026-98621, CVE-2026-98622, CVE-2026-98623,\nCVE-2026-98624, CVE-2026-98625, CVE-2026-98626, CVE-2026-98631,\nCVE-2026-98636, CVE-2026-98640, CVE-2026-98643, CVE-2026-98644,\nCVE-2026-98647, CVE-2026-98872, CVE-2026-98873, CVE-2026-98876,\nCVE-2026-98877, CVE-2026-98879, CVE-2026-98881, CVE-2026-98884,\nCVE-2026-98885, CVE-2026-98886, CVE-2026-98887, CVE-2026-98888,\nCVE-2026-98889, CVE-2026-98890, CVE-2026-98891, CVE-2026-98892,\nCVE-2026-98893, CVE-2026-98896, CVE-2026-98898, CVE-2026-98899,\nCVE-2026-98900, CVE-2026-98902, CVE-2026-98907, CVE-2026-98909,\nCVE-2026-98911, CVE-2026-98912)\n","status":"published","published":"2026-11-03T11:04:01Z","modified":"2026-11-09T12:53:08.826264984Z","updated_at":"2026-11-07T01:56:36.654634Z"}]}}