SUSE-IU-2026:7817-1: Security update of suse/sl-micro/6.1/rt-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Oct 13 08:20:42 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/rt-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7817-1
Image Tags : suse/sl-micro/6.1/rt-os-container:2.2.1 , suse/sl-micro/6.1/rt-os-container:2.2.1-5.195 , suse/sl-micro/6.1/rt-os-container:latest
Image Release : 5.195
Severity : important
Type : security
References : 1222538 1254408 1258298 1260474 1263017 1263602 1263865 1264747
1264807 1266008 1266410 1266735 1266848 1267373 1267464 1267564
1267648 1267985 1269000 1269532 1269685 1269816 1271817 1271906
1271955 1272145 1272215 1272426 1272471 1272473 1272572 1272793
1272847 1272890 1273059 1273251 1273258 1273309 1273339 1273420
1273512 1273522 1273750 1273759 1273776 1273782 1273870 1273879
1273889 1273899 1273938 1273953 1273976 1273999 1274010 1274036
1274037 1274245 1274316 1274319 1274494 1274637 1274730 1274776
1274803 1274836 1274838 1274890 1274920 1275092 1275094 1275129
1275156 1275455 1275495 1275540 1275542 1275543 1275545 1275549
1275559 1275567 1275588 1275681 1275684 1275685 1275690 1275694
1275799 1275802 1275866 1275924 1275953 1275972 1275977 1275985
1276006 1276007 1276009 1276277 1276287 1276295 1276337 1276338
1276339 1276340 1276341 1276349 1276352 1276353 1276354 1276381
1276388 1276395 1276445 1276460 1276461 1276462 1276468 1276473
1276474 1276475 1276504 1276508 1276512 1276519 1276528 1276532
1276535 1276538 1276547 1276553 1276563 1276565 1276570 1276572
1276573 1276579 1276766 1276767 1276783 1276793 1276801 1276803
1276814 1276818 1276821 1276840 1276865 1276866 1276876 1276880
1276891 1276905 1276921 1276922 1276923 1276930 1277023 1277030
1277032 1277036 1277070 1277078 1277092 1277098 1277108 1277109
1277114 1277115 1277120 1277122 1277128 1277129 1277143 1277148
1277149 1277179 1277215 1277217 1277218 1277229 1277231 1277233
1277235 1277245 1277249 1277254 1277268 1277272 1277296 1277308
1277314 1277321 1277328 1277335 1277342 1277349 1277350 1277371
1277372 1277374 1277392 1277396 1277401 1277405 1277410 1277452
1277489 1277493 1277505 1277513 1277544 1277553 1277555 1277556
1277557 1277558 1277561 1277571 1277574 1277590 1277615 1277626
1277640 1277649 1277655 1277656 1277662 1277674 1277705 1277728
1277738 1277748 1277761 1277764 1277766 1277781 1277783 1277784
1277792 1277796 1277801 1277805 1277813 1277818 1277820 1277822
1277823 1277837 1277840 1277843 1277857 1277860 1277862 1277874
1277876 1277885 1277892 1277896 1277897 1277898 1277900 1277901
1277904 1277906 1277908 1277910 1277915 1277918 1278031 1278035
1278053 1278054 1278056 1278063 1278067 1278070 1278087 1278088
1278091 1278094 1278098 1278100 1278108 1278113 1278132 1278155
1278178 1278180 1278191 1278195 1278199 1278205 1278210 1278211
1278216 1278225 1278233 1278236 1278240 1278245 1278247 1278253
1278255 1278293 1278294 1278311 1278314 1278315 1278324 1278331
1278335 1278395 1278416 1278708 1278716 1278733 1279422 1279487
1279497 1279525 1279527 1279532 1279535 1279536 1279580 1279581
1279619 1279621 1279786 1279799 1279811 1279813 1279819 1279835
1279847 1279850 1279875 1279878 1279888 1280139 1280143 1280146
1280148 1280151 1280178 1280184 1280206 1280235 1280237 1280243
1280252 1280263 1280296 1280298 1280338 1280350 1280375 1280379
1280383 1280387 1280388 1280449 1280451 1280455 1280456 1280468
1280487 1280490 1280496 1280508 1280509 1280518 1280544 1280546
1280548 1280551 1280577 1280711 1280716 1280717 1280719 1280726
1280727 1280733 1280750 1280758 1280786 1280797 1280870 1280872
1280923 1280985 1280993 1281010 1281042 1281046 1281054 1281057
1281077 1281085 1281201 1281202 1281224 1281226 1281229 1281231
1281273 1281295 1281358 1281359 1281379 1281383 1281387 1281397
1281399 1281408 1281427 1281496 1281514 1281546 1281599 1281644
1281680 1281694 1281717 1281732 1281738 1281777 1281778 1281786
1281789 1281793 1281795 1281808 1281818 1281825 1281922 1281927
1281955 1281964 1281973 1281988 1281993 1281995 1281997 1282020
1282034 1282040 1282041 1282042 1282050 1282054 1282072 1282104
1282110 1282113 1282143 1282170 1282193 1282197 1282270 1282271
1282284 1282286 1282288 1282383 1282648 1282672 1282767 1282774
1282803 1282810 1282812 1282823 1282881 1282891 1282906 1282997
1283121 1283154 1283163 1283176 1283201 1283213 1283230 1283312
1283500 1283805 1283935 1283973 1284146 CVE-2024-26730 CVE-2025-38704
CVE-2026-100075 CVE-2026-23128 CVE-2026-23352 CVE-2026-31523
CVE-2026-31689 CVE-2026-43409 CVE-2026-43448 CVE-2026-43502 CVE-2026-45836
CVE-2026-45872 CVE-2026-46044 CVE-2026-46135 CVE-2026-46149 CVE-2026-46196
CVE-2026-46304 CVE-2026-52912 CVE-2026-53061 CVE-2026-53090 CVE-2026-53284
CVE-2026-53384 CVE-2026-53400 CVE-2026-63795 CVE-2026-63883 CVE-2026-63890
CVE-2026-63913 CVE-2026-63956 CVE-2026-63963 CVE-2026-63993 CVE-2026-64003
CVE-2026-64009 CVE-2026-64038 CVE-2026-64046 CVE-2026-64103 CVE-2026-64173
CVE-2026-64205 CVE-2026-64210 CVE-2026-64213 CVE-2026-64279 CVE-2026-64283
CVE-2026-64297 CVE-2026-64299 CVE-2026-64319 CVE-2026-64320 CVE-2026-64372
CVE-2026-64373 CVE-2026-64402 CVE-2026-64405 CVE-2026-64425 CVE-2026-64474
CVE-2026-64475 CVE-2026-64476 CVE-2026-64507 CVE-2026-64528 CVE-2026-64542
CVE-2026-64556 CVE-2026-64570 CVE-2026-64579 CVE-2026-64580 CVE-2026-64589
CVE-2026-68096 CVE-2026-68141 CVE-2026-68146 CVE-2026-68148 CVE-2026-68162
CVE-2026-68198 CVE-2026-68253 CVE-2026-68258 CVE-2026-68273 CVE-2026-68290
CVE-2026-68294 CVE-2026-68338 CVE-2026-68376 CVE-2026-68441 CVE-2026-68445
CVE-2026-68448 CVE-2026-68451 CVE-2026-68452 CVE-2026-68454 CVE-2026-68471
CVE-2026-68477 CVE-2026-72012 CVE-2026-72017 CVE-2026-72019 CVE-2026-72023
CVE-2026-72025 CVE-2026-72045 CVE-2026-72051 CVE-2026-72052 CVE-2026-72053
CVE-2026-72054 CVE-2026-72055 CVE-2026-72061 CVE-2026-72063 CVE-2026-72066
CVE-2026-72084 CVE-2026-72085 CVE-2026-72086 CVE-2026-72098 CVE-2026-72102
CVE-2026-72106 CVE-2026-72107 CVE-2026-72108 CVE-2026-72129 CVE-2026-72130
CVE-2026-72135 CVE-2026-72136 CVE-2026-72138 CVE-2026-72157 CVE-2026-72161
CVE-2026-72163 CVE-2026-72164 CVE-2026-72166 CVE-2026-72218 CVE-2026-72219
CVE-2026-72224 CVE-2026-72237 CVE-2026-72242 CVE-2026-72243 CVE-2026-72247
CVE-2026-72256 CVE-2026-72282 CVE-2026-72297 CVE-2026-72299 CVE-2026-72306
CVE-2026-72321 CVE-2026-72322 CVE-2026-72323 CVE-2026-72325 CVE-2026-72330
CVE-2026-72339 CVE-2026-72347 CVE-2026-72348 CVE-2026-72349 CVE-2026-72350
CVE-2026-72351 CVE-2026-72352 CVE-2026-72379 CVE-2026-72383 CVE-2026-72392
CVE-2026-72398 CVE-2026-72399 CVE-2026-72404 CVE-2026-72406 CVE-2026-72413
CVE-2026-72421 CVE-2026-72425 CVE-2026-72433 CVE-2026-72434 CVE-2026-72435
CVE-2026-72436 CVE-2026-72437 CVE-2026-72438 CVE-2026-72439 CVE-2026-72440
CVE-2026-72444 CVE-2026-72447 CVE-2026-72448 CVE-2026-72449 CVE-2026-72450
CVE-2026-72459 CVE-2026-72460 CVE-2026-72487 CVE-2026-72488 CVE-2026-74255
CVE-2026-74256 CVE-2026-74257 CVE-2026-74258 CVE-2026-74261 CVE-2026-74267
CVE-2026-74268 CVE-2026-74270 CVE-2026-74278 CVE-2026-74281 CVE-2026-74282
CVE-2026-74283 CVE-2026-74284 CVE-2026-74288 CVE-2026-74289 CVE-2026-74290
CVE-2026-74302 CVE-2026-74307 CVE-2026-74308 CVE-2026-74310 CVE-2026-74313
CVE-2026-74317 CVE-2026-74330 CVE-2026-74346 CVE-2026-74349 CVE-2026-74356
CVE-2026-74359 CVE-2026-74363 CVE-2026-74365 CVE-2026-74375 CVE-2026-74376
CVE-2026-74377 CVE-2026-74378 CVE-2026-74382 CVE-2026-74384 CVE-2026-74385
CVE-2026-74386 CVE-2026-74388 CVE-2026-74389 CVE-2026-74390 CVE-2026-74391
CVE-2026-74397 CVE-2026-74398 CVE-2026-74406 CVE-2026-74443 CVE-2026-74444
CVE-2026-74450 CVE-2026-74453 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467
CVE-2026-74469 CVE-2026-74471 CVE-2026-74473 CVE-2026-74475 CVE-2026-74476
CVE-2026-74479 CVE-2026-74480 CVE-2026-74485 CVE-2026-74487 CVE-2026-74490
CVE-2026-74492 CVE-2026-74493 CVE-2026-74515 CVE-2026-74523 CVE-2026-74536
CVE-2026-74540 CVE-2026-74541 CVE-2026-74553 CVE-2026-74555 CVE-2026-74557
CVE-2026-74564 CVE-2026-74579 CVE-2026-74580 CVE-2026-74586 CVE-2026-74588
CVE-2026-74589 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597
CVE-2026-74598 CVE-2026-74600 CVE-2026-74601 CVE-2026-74603 CVE-2026-74608
CVE-2026-74609 CVE-2026-74612 CVE-2026-74615 CVE-2026-74616 CVE-2026-74622
CVE-2026-74625 CVE-2026-74630 CVE-2026-74631 CVE-2026-74632 CVE-2026-74636
CVE-2026-74637 CVE-2026-74638 CVE-2026-74659 CVE-2026-74660 CVE-2026-74663
CVE-2026-74666 CVE-2026-74667 CVE-2026-74671 CVE-2026-74688 CVE-2026-74689
CVE-2026-74696 CVE-2026-74697 CVE-2026-74700 CVE-2026-74701 CVE-2026-74705
CVE-2026-74710 CVE-2026-74713 CVE-2026-74718 CVE-2026-74719 CVE-2026-74725
CVE-2026-74726 CVE-2026-74735 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743
CVE-2026-74744 CVE-2026-74752 CVE-2026-80540 CVE-2026-80557 CVE-2026-80580
CVE-2026-80585 CVE-2026-80586 CVE-2026-80589 CVE-2026-80603 CVE-2026-80613
CVE-2026-80629 CVE-2026-80631 CVE-2026-80646 CVE-2026-80647 CVE-2026-80663
CVE-2026-80664 CVE-2026-80667 CVE-2026-80679 CVE-2026-80681 CVE-2026-80686
CVE-2026-80693 CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80722
CVE-2026-80725 CVE-2026-80731 CVE-2026-80737 CVE-2026-80739 CVE-2026-80747
CVE-2026-80756 CVE-2026-80785 CVE-2026-80789 CVE-2026-80793 CVE-2026-80799
CVE-2026-80805 CVE-2026-80836 CVE-2026-80840 CVE-2026-80841 CVE-2026-80842
CVE-2026-80844 CVE-2026-80846 CVE-2026-80847 CVE-2026-80848 CVE-2026-80852
CVE-2026-80863 CVE-2026-80864 CVE-2026-80865 CVE-2026-80880 CVE-2026-80909
CVE-2026-80932 CVE-2026-80976 CVE-2026-80983 CVE-2026-81000 CVE-2026-81001
CVE-2026-89448 CVE-2026-89451 CVE-2026-89477 CVE-2026-89479 CVE-2026-89480
CVE-2026-89481 CVE-2026-89482 CVE-2026-89485 CVE-2026-89508 CVE-2026-89510
CVE-2026-89511 CVE-2026-89525 CVE-2026-89531 CVE-2026-89532 CVE-2026-89533
CVE-2026-89536 CVE-2026-89538 CVE-2026-89539 CVE-2026-89540 CVE-2026-89541
CVE-2026-89542 CVE-2026-89544 CVE-2026-89547 CVE-2026-89548 CVE-2026-89550
CVE-2026-89551 CVE-2026-89564 CVE-2026-89569 CVE-2026-89580 CVE-2026-89603
CVE-2026-89609 CVE-2026-89631 CVE-2026-89636 CVE-2026-89638 CVE-2026-89644
CVE-2026-89662 CVE-2026-89663 CVE-2026-89665 CVE-2026-89671 CVE-2026-89672
CVE-2026-89673 CVE-2026-89674 CVE-2026-89680 CVE-2026-89684 CVE-2026-89686
CVE-2026-89694 CVE-2026-89696 CVE-2026-89697 CVE-2026-89699 CVE-2026-89702
CVE-2026-89704 CVE-2026-89707 CVE-2026-89710 CVE-2026-89712 CVE-2026-89713
CVE-2026-89784 CVE-2026-89789 CVE-2026-89899 CVE-2026-89912 CVE-2026-89913
CVE-2026-89929 CVE-2026-89930 CVE-2026-89931 CVE-2026-89968 CVE-2026-89970
CVE-2026-89984 CVE-2026-90003 CVE-2026-90074 CVE-2026-90088 CVE-2026-90097
CVE-2026-90104 CVE-2026-90149 CVE-2026-90151 CVE-2026-90182 CVE-2026-90183
CVE-2026-90198 CVE-2026-90203 CVE-2026-90218 CVE-2026-90228 CVE-2026-90255
CVE-2026-90259 CVE-2026-90263 CVE-2026-90265 CVE-2026-90292 CVE-2026-90293
CVE-2026-90294 CVE-2026-90307 CVE-2026-90308 CVE-2026-90309 CVE-2026-90358
CVE-2026-90388 CVE-2026-90413 CVE-2026-90414 CVE-2026-90415 CVE-2026-90417
CVE-2026-90434 CVE-2026-92495 CVE-2026-92500 CVE-2026-92503 CVE-2026-92507
CVE-2026-92508 CVE-2026-92509 CVE-2026-92510 CVE-2026-92511 CVE-2026-92512
CVE-2026-92514 CVE-2026-92523 CVE-2026-92525 CVE-2026-93037 CVE-2026-93102
CVE-2026-93103 CVE-2026-93104 CVE-2026-93107 CVE-2026-93108 CVE-2026-93109
CVE-2026-93110 CVE-2026-93154 CVE-2026-93207 CVE-2026-93212 CVE-2026-93264
CVE-2026-93269 CVE-2026-93782 CVE-2026-93794 CVE-2026-93810 CVE-2026-93813
CVE-2026-93826 CVE-2026-93829 CVE-2026-97421 CVE-2026-97477 CVE-2026-97505
CVE-2026-97557 CVE-2026-97934 CVE-2026-97940 CVE-2026-97950 CVE-2026-98003
CVE-2026-98080 CVE-2026-98091 CVE-2026-98164
-----------------------------------------------------------------
The container suse/sl-micro/6.1/rt-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: kernel-686
Released: Mon Oct 12 18:39:36 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1222538,1254408,1258298,1260474,1263017,1263602,1263865,1264747,1264807,1266008,1266410,1266735,1266848,1267373,1267464,1267564,1267648,1267985,1269000,1269532,1269685,1269816,1271817,1271906,1271955,1272145,1272215,1272426,1272471,1272473,1272572,1272793,1272847,1272890,1273059,1273251,1273258,1273309,1273339,1273420,1273512,1273522,1273750,1273759,1273776,1273782,1273870,1273879,1273889,1273899,1273938,1273953,1273976,1273999,1274010,1274036,1274037,1274245,1274316,1274319,1274494,1274637,1274730,1274776,1274803,1274836,1274838,1274890,1274920,1275092,1275094,1275129,1275156,1275455,1275495,1275540,1275542,1275543,1275545,1275549,1275559,1275567,1275588,1275681,1275684,1275685,1275690,1275694,1275799,1275802,1275866,1275924,1275953,1275972,1275977,1275985,1276006,1276007,1276009,1276277,1276287,1276295,1276337,1276338,1276339,1276340,1276341,1276349,1276352,1276353,1276354,1276381,1276388,1276395,1276445,1276460,1276461,1276462,1276468,1276473,1276474,1276475,1276504,1
276508,1276512,1276519,1276528,1276532,1276535,1276538,1276547,1276553,1276563,1276565,1276570,1276572,1276573,1276579,1276766,1276767,1276783,1276793,1276801,1276803,1276814,1276818,1276821,1276840,1276865,1276866,1276876,1276880,1276891,1276905,1276921,1276922,1276923,1276930,1277023,1277030,1277032,1277036,1277070,1277078,1277092,1277098,1277108,1277109,1277114,1277115,1277120,1277122,1277128,1277129,1277143,1277148,1277149,1277179,1277215,1277217,1277218,1277229,1277231,1277233,1277235,1277245,1277249,1277254,1277268,1277272,1277296,1277308,1277314,1277321,1277328,1277335,1277342,1277349,1277350,1277371,1277372,1277374,1277392,1277396,1277401,1277405,1277410,1277452,1277489,1277493,1277505,1277513,1277544,1277553,1277555,1277556,1277557,1277558,1277561,1277571,1277574,1277590,1277615,1277626,1277640,1277649,1277655,1277656,1277662,1277674,1277705,1277728,1277738,1277748,1277761,1277764,1277766,1277781,1277783,1277784,1277792,1277796,1277801,1277805,1277813,1277818,1277820,127782
2,1277823,1277837,1277840,1277843,1277857,1277860,1277862,1277874,1277876,1277885,1277892,1277896,1277897,1277898,1277900,1277901,1277904,1277906,1277908,1277910,1277915,1277918,1278031,1278035,1278053,1278054,1278056,1278063,1278067,1278070,1278087,1278088,1278091,1278094,1278098,1278100,1278108,1278113,1278132,1278155,1278178,1278180,1278191,1278195,1278199,1278205,1278210,1278211,1278216,1278225,1278233,1278236,1278240,1278245,1278247,1278253,1278255,1278293,1278294,1278311,1278314,1278315,1278324,1278331,1278335,1278395,1278416,1278708,1278716,1278733,1279422,1279487,1279497,1279525,1279527,1279532,1279535,1279536,1279580,1279581,1279619,1279621,1279786,1279799,1279811,1279813,1279819,1279835,1279847,1279850,1279875,1279878,1279888,1280139,1280143,1280146,1280148,1280151,1280178,1280184,1280206,1280235,1280237,1280243,1280252,1280263,1280296,1280298,1280338,1280350,1280375,1280379,1280383,1280387,1280388,1280449,1280451,1280455,1280456,1280468,1280487,1280490,1280496,1280508,128
0509,1280518,1280544,1280546,1280548,1280551,1280577,1280711,1280716,1280717,1280719,1280726,1280727,1280733,1280750,1280758,1280786,1280797,1280870,1280872,1280923,1280985,1280993,1281010,1281042,1281046,1281054,1281057,1281077,1281085,1281201,1281202,1281224,1281226,1281229,1281231,1281273,1281295,1281358,1281359,1281379,1281383,1281387,1281397,1281399,1281408,1281427,1281496,1281514,1281546,1281599,1281644,1281680,1281694,1281717,1281732,1281738,1281777,1281778,1281786,1281789,1281793,1281795,1281808,1281818,1281825,1281922,1281927,1281955,1281964,1281973,1281988,1281993,1281995,1281997,1282020,1282034,1282040,1282041,1282042,1282050,1282054,1282072,1282104,1282110,1282113,1282143,1282170,1282193,1282197,1282270,1282271,1282284,1282286,1282288,1282383,1282648,1282672,1282767,1282774,1282803,1282810,1282812,1282823,1282881,1282891,1282906,1282997,1283121,1283154,1283163,1283176,1283201,1283213,1283230,1283312,1283500,1283805,1283935,1283973,1284146,CVE-2024-26730,CVE-2025-38704,CV
E-2026-100075,CVE-2026-23128,CVE-2026-23352,CVE-2026-31523,CVE-2026-31689,CVE-2026-43409,CVE-2026-43448,CVE-2026-43502,CVE-2026-45836,CVE-2026-45872,CVE-2026-46044,CVE-2026-46135,CVE-2026-46149,CVE-2026-46196,CVE-2026-46304,CVE-2026-52912,CVE-2026-53061,CVE-2026-53090,CVE-2026-53284,CVE-2026-53384,CVE-2026-53400,CVE-2026-63795,CVE-2026-63883,CVE-2026-63890,CVE-2026-63913,CVE-2026-63956,CVE-2026-63963,CVE-2026-63993,CVE-2026-64003,CVE-2026-64009,CVE-2026-64038,CVE-2026-64046,CVE-2026-64103,CVE-2026-64173,CVE-2026-64205,CVE-2026-64210,CVE-2026-64213,CVE-2026-64279,CVE-2026-64283,CVE-2026-64297,CVE-2026-64299,CVE-2026-64319,CVE-2026-64320,CVE-2026-64372,CVE-2026-64373,CVE-2026-64402,CVE-2026-64405,CVE-2026-64425,CVE-2026-64474,CVE-2026-64475,CVE-2026-64476,CVE-2026-64507,CVE-2026-64528,CVE-2026-64542,CVE-2026-64556,CVE-2026-64570,CVE-2026-64579,CVE-2026-64580,CVE-2026-64589,CVE-2026-68096,CVE-2026-68141,CVE-2026-68146,CVE-2026-68148,CVE-2026-68162,CVE-2026-68198,CVE-2026-68253,CVE-2026
-68258,CVE-2026-68273,CVE-2026-68290,CVE-2026-68294,CVE-2026-68338,CVE-2026-68376,CVE-2026-68441,CVE-2026-68445,CVE-2026-68448,CVE-2026-68451,CVE-2026-68452,CVE-2026-68454,CVE-2026-68471,CVE-2026-68477,CVE-2026-72012,CVE-2026-72017,CVE-2026-72019,CVE-2026-72023,CVE-2026-72025,CVE-2026-72045,CVE-2026-72051,CVE-2026-72052,CVE-2026-72053,CVE-2026-72054,CVE-2026-72055,CVE-2026-72061,CVE-2026-72063,CVE-2026-72066,CVE-2026-72084,CVE-2026-72085,CVE-2026-72086,CVE-2026-72098,CVE-2026-72102,CVE-2026-72106,CVE-2026-72107,CVE-2026-72108,CVE-2026-72129,CVE-2026-72130,CVE-2026-72135,CVE-2026-72136,CVE-2026-72138,CVE-2026-72157,CVE-2026-72161,CVE-2026-72163,CVE-2026-72164,CVE-2026-72166,CVE-2026-72218,CVE-2026-72219,CVE-2026-72224,CVE-2026-72237,CVE-2026-72242,CVE-2026-72243,CVE-2026-72247,CVE-2026-72256,CVE-2026-72282,CVE-2026-72297,CVE-2026-72299,CVE-2026-72306,CVE-2026-72321,CVE-2026-72322,CVE-2026-72323,CVE-2026-72325,CVE-2026-72330,CVE-2026-72339,CVE-2026-72347,CVE-2026-72348,CVE-2026-72349,
CVE-2026-72350,CVE-2026-72351,CVE-2026-72352,CVE-2026-72379,CVE-2026-72383,CVE-2026-72392,CVE-2026-72398,CVE-2026-72399,CVE-2026-72404,CVE-2026-72406,CVE-2026-72413,CVE-2026-72421,CVE-2026-72425,CVE-2026-72433,CVE-2026-72434,CVE-2026-72435,CVE-2026-72436,CVE-2026-72437,CVE-2026-72438,CVE-2026-72439,CVE-2026-72440,CVE-2026-72444,CVE-2026-72447,CVE-2026-72448,CVE-2026-72449,CVE-2026-72450,CVE-2026-72459,CVE-2026-72460,CVE-2026-72487,CVE-2026-72488,CVE-2026-74255,CVE-2026-74256,CVE-2026-74257,CVE-2026-74258,CVE-2026-74261,CVE-2026-74267,CVE-2026-74268,CVE-2026-74270,CVE-2026-74278,CVE-2026-74281,CVE-2026-74282,CVE-2026-74283,CVE-2026-74284,CVE-2026-74288,CVE-2026-74289,CVE-2026-74290,CVE-2026-74302,CVE-2026-74307,CVE-2026-74308,CVE-2026-74310,CVE-2026-74313,CVE-2026-74317,CVE-2026-74330,CVE-2026-74346,CVE-2026-74349,CVE-2026-74356,CVE-2026-74359,CVE-2026-74363,CVE-2026-74365,CVE-2026-74375,CVE-2026-74376,CVE-2026-74377,CVE-2026-74378,CVE-2026-74382,CVE-2026-74384,CVE-2026-74385,CVE-202
6-74386,CVE-2026-74388,CVE-2026-74389,CVE-2026-74390,CVE-2026-74391,CVE-2026-74397,CVE-2026-74398,CVE-2026-74406,CVE-2026-74443,CVE-2026-74444,CVE-2026-74450,CVE-2026-74453,CVE-2026-74464,CVE-2026-74465,CVE-2026-74467,CVE-2026-74469,CVE-2026-74471,CVE-2026-74473,CVE-2026-74475,CVE-2026-74476,CVE-2026-74479,CVE-2026-74480,CVE-2026-74485,CVE-2026-74487,CVE-2026-74490,CVE-2026-74492,CVE-2026-74493,CVE-2026-74515,CVE-2026-74523,CVE-2026-74536,CVE-2026-74540,CVE-2026-74541,CVE-2026-74553,CVE-2026-74555,CVE-2026-74557,CVE-2026-74564,CVE-2026-74579,CVE-2026-74580,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74592,CVE-2026-74594,CVE-2026-74595,CVE-2026-74597,CVE-2026-74598,CVE-2026-74600,CVE-2026-74601,CVE-2026-74603,CVE-2026-74608,CVE-2026-74609,CVE-2026-74612,CVE-2026-74615,CVE-2026-74616,CVE-2026-74622,CVE-2026-74625,CVE-2026-74630,CVE-2026-74631,CVE-2026-74632,CVE-2026-74636,CVE-2026-74637,CVE-2026-74638,CVE-2026-74659,CVE-2026-74660,CVE-2026-74663,CVE-2026-74666,CVE-2026-74667
,CVE-2026-74671,CVE-2026-74688,CVE-2026-74689,CVE-2026-74696,CVE-2026-74697,CVE-2026-74700,CVE-2026-74701,CVE-2026-74705,CVE-2026-74710,CVE-2026-74713,CVE-2026-74718,CVE-2026-74719,CVE-2026-74725,CVE-2026-74726,CVE-2026-74735,CVE-2026-74737,CVE-2026-74739,CVE-2026-74743,CVE-2026-74744,CVE-2026-74752,CVE-2026-80540,CVE-2026-80557,CVE-2026-80580,CVE-2026-80585,CVE-2026-80586,CVE-2026-80589,CVE-2026-80603,CVE-2026-80613,CVE-2026-80629,CVE-2026-80631,CVE-2026-80646,CVE-2026-80647,CVE-2026-80663,CVE-2026-80664,CVE-2026-80667,CVE-2026-80679,CVE-2026-80681,CVE-2026-80686,CVE-2026-80693,CVE-2026-80714,CVE-2026-80715,CVE-2026-80716,CVE-2026-80722,CVE-2026-80725,CVE-2026-80731,CVE-2026-80737,CVE-2026-80739,CVE-2026-80747,CVE-2026-80756,CVE-2026-80785,CVE-2026-80789,CVE-2026-80793,CVE-2026-80799,CVE-2026-80805,CVE-2026-80836,CVE-2026-80840,CVE-2026-80841,CVE-2026-80842,CVE-2026-80844,CVE-2026-80846,CVE-2026-80847,CVE-2026-80848,CVE-2026-80852,CVE-2026-80863,CVE-2026-80864,CVE-2026-80865,CVE-20
26-80880,CVE-2026-80909,CVE-2026-80932,CVE-2026-80976,CVE-2026-80983,CVE-2026-81000,CVE-2026-81001,CVE-2026-89448,CVE-2026-89451,CVE-2026-89477,CVE-2026-89479,CVE-2026-89480,CVE-2026-89481,CVE-2026-89482,CVE-2026-89485,CVE-2026-89508,CVE-2026-89510,CVE-2026-89511,CVE-2026-89525,CVE-2026-89531,CVE-2026-89532,CVE-2026-89533,CVE-2026-89536,CVE-2026-89538,CVE-2026-89539,CVE-2026-89540,CVE-2026-89541,CVE-2026-89542,CVE-2026-89544,CVE-2026-89547,CVE-2026-89548,CVE-2026-89550,CVE-2026-89551,CVE-2026-89564,CVE-2026-89569,CVE-2026-89580,CVE-2026-89603,CVE-2026-89609,CVE-2026-89631,CVE-2026-89636,CVE-2026-89638,CVE-2026-89644,CVE-2026-89662,CVE-2026-89663,CVE-2026-89665,CVE-2026-89671,CVE-2026-89672,CVE-2026-89673,CVE-2026-89674,CVE-2026-89680,CVE-2026-89684,CVE-2026-89686,CVE-2026-89694,CVE-2026-89696,CVE-2026-89697,CVE-2026-89699,CVE-2026-89702,CVE-2026-89704,CVE-2026-89707,CVE-2026-89710,CVE-2026-89712,CVE-2026-89713,CVE-2026-89784,CVE-2026-89789,CVE-2026-89899,CVE-2026-89912,CVE-2026-8991
3,CVE-2026-89929,CVE-2026-89930,CVE-2026-89931,CVE-2026-89968,CVE-2026-89970,CVE-2026-89984,CVE-2026-90003,CVE-2026-90074,CVE-2026-90088,CVE-2026-90097,CVE-2026-90104,CVE-2026-90149,CVE-2026-90151,CVE-2026-90182,CVE-2026-90183,CVE-2026-90198,CVE-2026-90203,CVE-2026-90218,CVE-2026-90228,CVE-2026-90255,CVE-2026-90259,CVE-2026-90263,CVE-2026-90265,CVE-2026-90292,CVE-2026-90293,CVE-2026-90294,CVE-2026-90307,CVE-2026-90308,CVE-2026-90309,CVE-2026-90358,CVE-2026-90388,CVE-2026-90413,CVE-2026-90414,CVE-2026-90415,CVE-2026-90417,CVE-2026-90434,CVE-2026-92495,CVE-2026-92500,CVE-2026-92503,CVE-2026-92507,CVE-2026-92508,CVE-2026-92509,CVE-2026-92510,CVE-2026-92511,CVE-2026-92512,CVE-2026-92514,CVE-2026-92523,CVE-2026-92525,CVE-2026-93037,CVE-2026-93102,CVE-2026-93103,CVE-2026-93104,CVE-2026-93107,CVE-2026-93108,CVE-2026-93109,CVE-2026-93110,CVE-2026-93154,CVE-2026-93207,CVE-2026-93212,CVE-2026-93264,CVE-2026-93269,CVE-2026-93782,CVE-2026-93794,CVE-2026-93810,CVE-2026-93813,CVE-2026-93826,CVE-2
026-93829,CVE-2026-97421,CVE-2026-97477,CVE-2026-97505,CVE-2026-97557,CVE-2026-97934,CVE-2026-97940,CVE-2026-97950,CVE-2026-98003,CVE-2026-98080,CVE-2026-98091,CVE-2026-98164
The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
- CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
- CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
- CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
- CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
- CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
- CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
- CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
(bsc#1272890).
- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
- CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
- CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
- CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
- CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (bsc#1273512).
- CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522).
- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).
- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).
- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).
- CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847).
- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).
- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
- CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure (bsc#1274010).
- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494).
- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).
- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).
- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).
- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).
- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).
- CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow (bsc#1275156).
- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).
- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).
- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).
- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).
- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).
- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).
- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).
- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).
- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).
- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542).
- CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).
- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).
- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).
- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549).
- CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).
- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
- CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235).
- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).
- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).
- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).
- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).
- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).
- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).
- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).
- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).
- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).
- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).
- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).
- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).
- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).
- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).
- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).
- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).
- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).
- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).
- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).
- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).
- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).
- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).
- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).
- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).
- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).
- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).
- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).
- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).
- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).
- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).
- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).
- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).
- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).
- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).
- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).
- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).
- CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132).
- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).
- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).
- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
- CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445).
- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).
- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).
- CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891).
- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).
- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).
- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).
- CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).
- CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
- CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225).
- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).
- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).
- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).
- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).
- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).
- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).
- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).
- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).
- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).
- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).
- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).
- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).
- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).
- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).
- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).
- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
- CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).
- CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684).
- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).
- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).
- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).
- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).
- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).
- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).
- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).
- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).
- CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).
- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).
- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).
- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).
- CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372).
- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).
- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).
- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).
- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).
- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).
- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).
- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).
- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).
- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
(bsc#1276572).
- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).
- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).
- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).
- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).
- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).
- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).
- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).
- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).
- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).
- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).
- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).
- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).
- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).
- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).
- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).
- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).
- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).
- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).
- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
- CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).
- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).
- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).
- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).
- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
- CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).
- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).
- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).
- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).
- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).
- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).
- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
- CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383).
- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).
- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).
- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).
- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).
- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).
- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).
- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).
- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).
- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793).
- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
- CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).
- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).
- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).
- CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252).
- CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235).
- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).
- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).
- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).
- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).
- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).
- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).
- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).
- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).
- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).
- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).
- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
- CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).
- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).
- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).
- CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358).
- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).
- CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231).
- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).
- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).
- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).
- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).
- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).
- CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694).
- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).
- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).
- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).
- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).
- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
- CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).
- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).
- CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193).
- CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383).
- CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988).
- CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034).
- CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040).
- CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041).
- CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042).
- CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995).
- CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997).
- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).
- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).
- CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170).
- CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286).
- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).
- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).
- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).
- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).
- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).
- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).
- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
- CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).
- CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767).
- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).
- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).
- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).
- CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500).
- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).
- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
- CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (bsc#1283121).
- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).
- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).
- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).
- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).
- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).
- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).
- ACPICA: add boundary checks in two places (stable-fixes).
- ACPICA: Add package limit checks in parser functions (stable-fixes).
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).
- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).
- ACPICA: Prevent adding invalid references (stable-fixes).
- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).
- ACPICA: validate handler object type in two places (stable-fixes).
- ALSA: 6fire: Clean ups with guard() (stable-fixes).
- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).
- ALSA: aloop: Check card index validity at probe (stable-fixes).
- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).
- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).
- ALSA: caiaq: Fix potential double-free at error path (git-fixes).
- ALSA: caiaq: unregister the input device when probe fails (git-fixes).
- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).
- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).
- ALSA: es18xx: check control allocation before private data setup (stable-fixes).
- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).
- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).
- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).
- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).
- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).
- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).
- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).
- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).
- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).
- ALSA: line6: reject oversized playback packets (git-fixes).
- ALSA: mpu401: Check card index validity at probe (stable-fixes).
- ALSA: mts64: Check card index validity at probe (stable-fixes).
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).
- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).
- ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes).
- ALSA: portman2x4: Check card index validity at probe (stable-fixes).
- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).
- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).
- ALSA: seq: Serialize compat port-info ioctls (git-fixes).
- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).
- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).
- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).
- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).
- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).
- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).
- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).
- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).
- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).
- ALSA: virmidi: Check card index validity at probe (stable-fixes).
- ALSA: virtio: reset device before deleting virtqueues (git-fixes).
- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
- arm64: percpu: Fix this_cpu_write() casting (git-fixes).
- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
- ASoC: ab8500: Correct digital interface format setup (git-fixes).
- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).
- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).
- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).
- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).
- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).
- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).
- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).
- ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).
- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).
- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes).
- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).
- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).
- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).
- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).
- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).
- ASoC: mt6351: Publish the OF module alias (git-fixes).
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).
- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).
- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).
- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).
- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).
- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).
- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).
- ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes).
- ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes).
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).
- ASoC: ux500: Program the MSP FIFO watermarks (git-fixes).
- ASoC: ux500: Propagate MSP setup errors (git-fixes).
- ASoC: ux500: Request the MSP MMIO resource (git-fixes).
- ASoC: ux500: Validate MSP DAI configuration (git-fixes).
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).
- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).
- Bluetooth: btintel: Export few static functions (stable-fixes).
- Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes).
- Bluetooth: btintel: Print firmware SHA1 (stable-fixes).
- Bluetooth: btintel: validate version TLV value lengths (git-fixes).
- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).
- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).
- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).
- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).
- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).
- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).
- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).
- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).
- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).
- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).
- Bluetooth: eir: validate service data length before reading UUID (git-fixes).
- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).
- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).
- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).
- Bluetooth: hci_sock: validate event length before filtering (git-fixes).
- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).
- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).
- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).
- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).
- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).
- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).
- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes).
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).
- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).
- bnxt_en: use irq_update_affinity_hint() (bsc#1280750).
- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).
- bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes).
- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).
- char/nvram: Remove redundant nvram_mutex (stable-fixes).
- compiler_types: Introduce __flex_counter() and family (bsc#1280139).
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).
- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).
- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).
- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).
- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).
- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).
- driver core: Better advertise dev_err_probe() (stable-fixes).
- driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes).
- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).
- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).
- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).
- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).
- drm/amdgpu: check ras and obj before dereference (git-fixes).
- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).
- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).
- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).
- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).
- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).
- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).
- drm/amdgpu: increase hmm range get pages timeout (stable-fixes).
- drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes).
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).
- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).
- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).
- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes).
- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).
- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).
- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).
- drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes).
- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).
- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).
- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).
- drm/ast: Automatically clean up poll helper (stable-fixes).
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).
- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).
- drm/cirrus: Use video aperture helpers (stable-fixes).
- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).
- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).
- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).
- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).
- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).
- drm/gud: validate TV mode names before creating enum property (git-fixes).
- drm/i915: fix incorrect RCU teardown order (git-fixes).
- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).
- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).
- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).
- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).
- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).
- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).
- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).
- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).
- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).
- drm/nouveau: Use write-combined maps for coherent (git-fixes).
- drm/omap: dsi: Do not copy isr table (git-fixes).
- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).
- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).
- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).
- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).
- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).
- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).
- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).
- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).
- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).
- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).
- fbdev: vfb: defer cleanup until the last reference (git-fixes).
- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).
- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).
- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).
- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).
- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).
- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).
- gpio: zynq: fix runtime PM leak on request error path (git-fixes).
- HID: alps: fix use-after-free on input2 registration failure (git-fixes).
- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).
- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).
- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).
- HID: ft260: validate i2c input report length (stable-fixes).
- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes).
- HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes).
- HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes).
- HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes).
- HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes).
- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes).
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).
- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).
- HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes).
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).
- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).
- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).
- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).
- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).
- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).
- hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes).
- hwmon: (emc1403) Add support for EMC1442 (stable-fixes).
- hwmon: (emc1403) Convert to with_info API (stable-fixes).
- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).
- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).
- hwmon: (emc1403) Support 11 bit accuracy (stable-fixes).
- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).
- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).
- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes).
- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).
- hwmon: (w83793) release probe data through kref (git-fixes).
- i2c: at91: release DMA channels on remove and probe error (git-fixes).
- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
- i2c: imx: release DMA channels on probe error (git-fixes).
- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes).
- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (git-fixes).
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).
- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes).
- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).
- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).
- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).
- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).
- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).
- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).
- iio: accel: sca3000: fix frequency divider condition check (git-fixes).
- iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes).
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).
- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).
- iio: buffer: serialize buffer teardown with mode claims (git-fixes).
- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).
- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).
- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).
- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).
- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).
- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).
- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).
- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).
- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).
- inode: make __iget() a static inline (bsc#1282383).
- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).
- Input: aiptek - validate raw macro indices before updating state (stable-fixes).
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).
- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).
- Input: eeti_ts - publish the OF module alias (git-fixes).
- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).
- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).
- Input: soc_button_array - check btns_desc->package.count (git-fixes).
- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).
- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).
- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).
- Input: xpad - add support for Azeron devices (stable-fixes).
- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).
- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).
- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).
- integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes).
- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).
- keys: fix lost wakeup when reaping a dead key type (git-fixes).
- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).
- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).
- KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes).
- KVM: nVMX: Always flush vpid02 on first use (git-fixes).
- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).
- KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel (git-fixes).
- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).
- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).
- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).
- KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes).
- KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes).
- KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes).
- KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes).
- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).
- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).
- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).
- media: hevc: add bounded tile-count helpers (git-fixes).
- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).
- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).
- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).
- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).
- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).
- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).
- media: video-i2c: fix buffer queue ordering (stable-fixes).
- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).
- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).
- mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes).
- mfd: rsmu: Add 8a34002 support (stable-fixes).
- mmc: core: Add validation for host-provided max_segs (stable-fixes).
- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).
- mmc: core: Fix OF node reference leak on card add failure (git-fixes).
- mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes).
- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).
- mmc: hsq: Fix use-after-free in retry work (git-fixes).
- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).
- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).
- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).
- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).
- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
- net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).
- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).
- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).
- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).
- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes).
- net: usb: sr9700: include receive overhead in the length check (git-fixes).
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).
- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).
- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).
- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).
- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).
- nfc: nfcmrvl: validate helper command length before pull (git-fixes).
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).
- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).
- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).
- nfc: st21nfca: validate received frame size (git-fixes).
- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).
- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).
- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes).
- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).
- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).
- PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes).
- PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes).
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes).
- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).
- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).
- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).
- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).
- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).
- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).
- PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes).
- PCI: xgene: Drop unnecessary OF node reference (git-fixes).
- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).
- perf: Reject exited events as group leaders (git-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).
- pinctrl: meson: Fix typo in s4 group name (git-fixes).
- pinctrl: single: free the IRQ on domain creation failure (git-fixes).
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).
- power: supply: sc2731_charger: cancel work on remove (git-fixes).
- power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes).
- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).
- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).
- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).
- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).
- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).
- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).
- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).
- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).
- RDMA/hfi1: Create workqueues before device initialization (git-fixes).
- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).
- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).
- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).
- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).
- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).
- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).
- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).
- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).
- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).
- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
- rtc: aspeed: add AST2700 compatible (stable-fixes).
- rtc: bq32000: add delay between RTC reads (stable-fixes).
- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).
- selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).
- selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).
- selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).
- serial: 8250: fix possible ISR soft lockup (stable-fixes).
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).
- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
- slab: Introduce kmalloc_flex() and family (bsc#1280139).
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
- smb: client: harden DFS cache against invalid target hints (git-fixes).
- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).
- soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes).
- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).
- soundwire: only handle alert events when the peripheral is attached (stable-fixes).
- soundwire: validate DT compatible before parsing it (stable-fixes).
- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes).
- spi: core: Abort active target transfer on controller suspend (stable-fixes).
- spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes).
- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes).
- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).
- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).
- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).
- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).
- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).
- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).
- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).
- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).
- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).
- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).
- thunderbolt: Reject oversized XDomain properties responses (git-fixes).
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).
- thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes).
- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).
- tls: add counters for rekey (bsc#1267564 jsc#PED-16401).
- tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).
- tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).
- tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).
- tty: vt: fix memory leak in vc_allocate() (git-fixes).
- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).
- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).
- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).
- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).
- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).
- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).
- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).
- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).
- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).
- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).
- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).
- usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes).
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).
- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes).
- usb: gadget: udc: skip pullup() if already connected (stable-fixes).
- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).
- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).
- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).
- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).
- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).
- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).
- usb: ohci-st: disable controller wakeup on removal (git-fixes).
- USB: serial: fix driver deregistration order (git-fixes).
- USB: serial: fix dynamic id driver deregistration race (git-fixes).
- USB: serial: fix port tear down use-after-free (git-fixes).
- USB: serial: quatech2: fix baud rate overflow (git-fixes).
- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).
- USB: serial: ssu100: fix baud rate overflow (git-fixes).
- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).
- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).
- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).
- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).
- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).
- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).
- usb: usbtest: disable dynamic ID support (stable-fixes).
- usb: usbtmc: don't store usb_device_id (stable-fixes).
- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).
- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).
- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).
- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: digicolor: Avoid division by zero (git-fixes).
- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).
- watchdog: msc313e: Avoid division by zero (git-fixes).
- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).
- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).
- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).
- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).
- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).
- watchdog: msc313e: Fix undefined behavior (git-fixes).
- watchdog: msc313e: Propagate error code in resume() (git-fixes).
- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).
- watchdog: rtd119x: Avoid division by zero (git-fixes).
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).
- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).
- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).
- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes).
- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).
- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).
- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: ath11k: implement handling of P2P NoA event (stable-fixes).
- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).
- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).
- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).
- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).
- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).
- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).
- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).
- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).
- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).
- wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes).
- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).
- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).
- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).
- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).
- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).
- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).
- wifi: libertas: reject short monitor TX frames (stable-fixes).
- wifi: libipw: fix key index receive bound checks (stable-fixes).
- wifi: libipw: reject too-short association responses (git-fixes).
- wifi: libipw: reject too-short beacon and probe responses (git-fixes).
- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).
- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).
- wifi: mac80211: don't access the TSF of a down interface (git-fixes).
- wifi: mac80211: don't allow link changes when iface is down (git-fixes).
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).
- wifi: mac80211: don't start a ROC while scanning (git-fixes).
- wifi: mac80211: mesh: release the channel if start fails (git-fixes).
- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).
- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).
- wifi: mac80211: reset state when starting AP fails (git-fixes).
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).
- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).
- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).
- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).
- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).
- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes).
- wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes).
- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).
- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).
- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).
- wifi: mwifiex: validate action frame fixed fields (git-fixes).
- wifi: mwifiex: validate scan response extents (git-fixes).
- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).
- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).
- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).
- wifi: rsi: fix heap OOB write on key removal (git-fixes).
- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).
- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes).
- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).
- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).
- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).
- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).
- wifi: virt_wifi: don't transfer operstate before register (git-fixes).
- wifi: virt_wifi: free skb when disconnected (git-fixes).
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).
- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).
- x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).
- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).
The following package changes have been done:
- kernel-rt-6.4.0-159998.53.1 updated
- container:SL-Micro-container-2.2.1-7.185 updated
More information about the sle-container-updates
mailing list