SUSE-IU-2026:7832-1: Security update of suse/sl-micro/6.2/kvm-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Oct 13 08:59:34 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.2/kvm-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7832-1
Image Tags : suse/sl-micro/6.2/kvm-os-container:2.3.1 , suse/sl-micro/6.2/kvm-os-container:2.3.1-8.167 , suse/sl-micro/6.2/kvm-os-container:latest
Image Release : 8.167
Severity : important
Type : security
References : 1211886 1243708 1253340 1258335 1260474 1261564 1261816 1263098
1264330 1264607 1264747 1266410 1266848 1267464 1267672 1271817
1271901 1271950 1272145 1272215 1272347 1272388 1272473 1272571
1272802 1272803 1272890 1273040 1273059 1273116 1273258 1273275
1273290 1273297 1273320 1273491 1273512 1273784 1273879 1273889
1273938 1273970 1273976 1273982 1274037 1274061 1274245 1274297
1274298 1274316 1274319 1274538 1274629 1274663 1274776 1274818
1274824 1274836 1274890 1274912 1274920 1275137 1275142 1275170
1275495 1275543 1275545 1275549 1275559 1275567 1275682 1275740
1275924 1275953 1275972 1275977 1276007 1276009 1276262 1276287
1276295 1276337 1276338 1276340 1276345 1276347 1276349 1276352
1276353 1276388 1276460 1276461 1276462 1276474 1276475 1276504
1276508 1276519 1276532 1276535 1276538 1276563 1276565 1276570
1276573 1276579 1276783 1276852 1276921 1276923 1276927 1276930
1276947 1277030 1277032 1277036 1277098 1277101 1277109 1277122
1277128 1277129 1277143 1277149 1277153 1277215 1277217 1277218
1277234 1277245 1277272 1277277 1277296 1277314 1277342 1277371
1277372 1277374 1277379 1277382 1277392 1277396 1277401 1277405
1277410 1277452 1277489 1277493 1277555 1277556 1277557 1277558
1277568 1277615 1277625 1277626 1277640 1277662 1277674 1277705
1277766 1277781 1277784 1277792 1277801 1277805 1277820 1277823
1277824 1277840 1277843 1277844 1277857 1277864 1277885 1277892
1277895 1277896 1277897 1277900 1277904 1277906 1277910 1277913
1277915 1278031 1278035 1278053 1278054 1278056 1278063 1278067
1278087 1278091 1278100 1278191 1278195 1278199 1278205 1278215
1278216 1278225 1278245 1278247 1278255 1278311 1278314 1278315
1278363 1278708 1279116 1279497 1279525 1279527 1279532 1279535
1279536 1279569 1279581 1279590 1279621 1279702 1279786 1279799
1279819 1279835 1279850 1279875 1279878 1279888 1280143 1280146
1280148 1280151 1280163 1280166 1280171 1280178 1280179 1280184
1280193 1280206 1280235 1280237 1280243 1280251 1280252 1280263
1280296 1280298 1280299 1280303 1280309 1280333 1280334 1280335
1280336 1280338 1280350 1280375 1280379 1280383 1280384 1280387
1280388 1280449 1280451 1280455 1280456 1280464 1280468 1280477
1280487 1280488 1280490 1280494 1280508 1280509 1280518 1280525
1280544 1280546 1280548 1280551 1280576 1280577 1280711 1280716
1280717 1280719 1280720 1280726 1280727 1280733 1280758 1280761
1280766 1280786 1280797 1280870 1280872 1280901 1280920 1280923
1280969 1280985 1280993 1281010 1281014 1281025 1281054 1281057
1281077 1281085 1281136 1281201 1281202 1281224 1281226 1281228
1281229 1281231 1281273 1281295 1281379 1281387 1281399 1281408
1281496 1281514 1281525 1281546 1281597 1281599 1281644 1281645
1281660 1281680 1281682 1281683 1281717 1281732 1281738 1281754
1281777 1281778 1281786 1281789 1281795 1281808 1281825 1281845
1281922 1281955 1281956 1281964 1281973 1281991 1282003 1282013
1282020 1282050 1282054 1282072 1282104 1282110 1282113 1282143
1282147 1282197 1282270 1282271 1282288 1282648 1282672 1282745
1282747 1282774 1282803 1282808 1282812 1282823 1282881 1282891
1282906 1282975 1282997 1283119 1283130 1283149 1283154 1283163
1283166 1283173 1283176 1283201 1283203 1283205 1283213 1283230
1283296 1283312 1283328 1283450 1283475 1283479 1283489 1283490
1283517 1283739 1283794 1283795 1283805 1283880 1283906 1283945
1284146 822653 CVE-2025-40136 CVE-2026-100075 CVE-2026-23199
CVE-2026-23352 CVE-2026-43210 CVE-2026-43272 CVE-2026-43409 CVE-2026-45836
CVE-2026-46044 CVE-2026-46196 CVE-2026-46272 CVE-2026-53377 CVE-2026-53384
CVE-2026-63838 CVE-2026-63881 CVE-2026-63913 CVE-2026-63956 CVE-2026-63983
CVE-2026-64009 CVE-2026-64046 CVE-2026-64070 CVE-2026-64132 CVE-2026-64154
CVE-2026-64173 CVE-2026-64205 CVE-2026-64216 CVE-2026-64235 CVE-2026-64297
CVE-2026-64299 CVE-2026-64324 CVE-2026-64372 CVE-2026-64377 CVE-2026-64388
CVE-2026-64402 CVE-2026-64405 CVE-2026-64414 CVE-2026-64418 CVE-2026-64422
CVE-2026-64448 CVE-2026-64457 CVE-2026-64473 CVE-2026-64474 CVE-2026-64475
CVE-2026-64476 CVE-2026-64580 CVE-2026-64594 CVE-2026-64597 CVE-2026-64598
CVE-2026-68146 CVE-2026-68162 CVE-2026-68264 CVE-2026-68266 CVE-2026-68290
CVE-2026-68312 CVE-2026-68343 CVE-2026-68367 CVE-2026-68376 CVE-2026-68382
CVE-2026-68385 CVE-2026-68400 CVE-2026-68441 CVE-2026-68451 CVE-2026-68452
CVE-2026-68454 CVE-2026-68471 CVE-2026-68477 CVE-2026-72012 CVE-2026-72018
CVE-2026-72025 CVE-2026-72066 CVE-2026-72070 CVE-2026-72098 CVE-2026-72102
CVE-2026-72128 CVE-2026-72129 CVE-2026-72130 CVE-2026-72147 CVE-2026-72166
CVE-2026-72218 CVE-2026-72219 CVE-2026-72224 CVE-2026-72237 CVE-2026-72247
CVE-2026-72256 CVE-2026-72299 CVE-2026-72321 CVE-2026-72322 CVE-2026-72348
CVE-2026-72349 CVE-2026-72351 CVE-2026-72352 CVE-2026-72383 CVE-2026-72392
CVE-2026-72404 CVE-2026-72406 CVE-2026-72413 CVE-2026-72433 CVE-2026-72434
CVE-2026-72435 CVE-2026-72436 CVE-2026-72444 CVE-2026-72447 CVE-2026-72491
CVE-2026-74256 CVE-2026-74257 CVE-2026-74258 CVE-2026-74267 CVE-2026-74268
CVE-2026-74281 CVE-2026-74283 CVE-2026-74288 CVE-2026-74289 CVE-2026-74290
CVE-2026-74330 CVE-2026-74356 CVE-2026-74359 CVE-2026-74365 CVE-2026-74376
CVE-2026-74384 CVE-2026-74385 CVE-2026-74386 CVE-2026-74389 CVE-2026-74391
CVE-2026-74398 CVE-2026-74440 CVE-2026-74449 CVE-2026-74450 CVE-2026-74465
CVE-2026-74467 CVE-2026-74469 CVE-2026-74471 CVE-2026-74473 CVE-2026-74480
CVE-2026-74483 CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74490
CVE-2026-74492 CVE-2026-74493 CVE-2026-74515 CVE-2026-74538 CVE-2026-74564
CVE-2026-74579 CVE-2026-74580 CVE-2026-74586 CVE-2026-74588 CVE-2026-74589
CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597
CVE-2026-74600 CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74605
CVE-2026-74606 CVE-2026-74609 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630
CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74636 CVE-2026-74637
CVE-2026-74638 CVE-2026-74659 CVE-2026-74660 CVE-2026-74662 CVE-2026-74663
CVE-2026-74666 CVE-2026-74667 CVE-2026-74671 CVE-2026-74688 CVE-2026-74689
CVE-2026-74692 CVE-2026-74694 CVE-2026-74696 CVE-2026-74697 CVE-2026-74700
CVE-2026-74701 CVE-2026-74710 CVE-2026-74713 CVE-2026-74718 CVE-2026-74725
CVE-2026-74726 CVE-2026-74735 CVE-2026-74739 CVE-2026-74745 CVE-2026-74752
CVE-2026-80521 CVE-2026-80585 CVE-2026-80613 CVE-2026-80631 CVE-2026-80664
CVE-2026-80679 CVE-2026-80686 CVE-2026-80694 CVE-2026-80715 CVE-2026-80725
CVE-2026-80747 CVE-2026-80756 CVE-2026-80779 CVE-2026-80789 CVE-2026-80793
CVE-2026-80836 CVE-2026-80840 CVE-2026-80841 CVE-2026-80842 CVE-2026-80844
CVE-2026-80846 CVE-2026-80847 CVE-2026-80848 CVE-2026-80851 CVE-2026-80852
CVE-2026-80863 CVE-2026-80864 CVE-2026-80865 CVE-2026-80880 CVE-2026-80895
CVE-2026-80932 CVE-2026-80976 CVE-2026-80979 CVE-2026-80980 CVE-2026-80983
CVE-2026-80984 CVE-2026-81000 CVE-2026-81001 CVE-2026-89448 CVE-2026-89451
CVE-2026-89453 CVE-2026-89477 CVE-2026-89479 CVE-2026-89480 CVE-2026-89481
CVE-2026-89482 CVE-2026-89485 CVE-2026-89500 CVE-2026-89501 CVE-2026-89502
CVE-2026-89503 CVE-2026-89508 CVE-2026-89510 CVE-2026-89511 CVE-2026-89525
CVE-2026-89526 CVE-2026-89527 CVE-2026-89530 CVE-2026-89531 CVE-2026-89532
CVE-2026-89533 CVE-2026-89534 CVE-2026-89535 CVE-2026-89536 CVE-2026-89538
CVE-2026-89539 CVE-2026-89540 CVE-2026-89541 CVE-2026-89542 CVE-2026-89544
CVE-2026-89545 CVE-2026-89547 CVE-2026-89548 CVE-2026-89550 CVE-2026-89551
CVE-2026-89564 CVE-2026-89569 CVE-2026-89580 CVE-2026-89603 CVE-2026-89644
CVE-2026-89658 CVE-2026-89660 CVE-2026-89662 CVE-2026-89663 CVE-2026-89665
CVE-2026-89669 CVE-2026-89671 CVE-2026-89672 CVE-2026-89673 CVE-2026-89674
CVE-2026-89680 CVE-2026-89683 CVE-2026-89684 CVE-2026-89685 CVE-2026-89686
CVE-2026-89688 CVE-2026-89690 CVE-2026-89691 CVE-2026-89694 CVE-2026-89696
CVE-2026-89697 CVE-2026-89698 CVE-2026-89699 CVE-2026-89702 CVE-2026-89703
CVE-2026-89704 CVE-2026-89705 CVE-2026-89706 CVE-2026-89707 CVE-2026-89710
CVE-2026-89712 CVE-2026-89713 CVE-2026-89747 CVE-2026-89780 CVE-2026-89784
CVE-2026-89789 CVE-2026-89791 CVE-2026-89798 CVE-2026-89912 CVE-2026-89913
CVE-2026-89968 CVE-2026-89970 CVE-2026-89984 CVE-2026-90003 CVE-2026-90065
CVE-2026-90074 CVE-2026-90097 CVE-2026-90101 CVE-2026-90104 CVE-2026-90142
CVE-2026-90149 CVE-2026-90150 CVE-2026-90151 CVE-2026-90177 CVE-2026-90182
CVE-2026-90183 CVE-2026-90203 CVE-2026-90218 CVE-2026-90228 CVE-2026-90240
CVE-2026-90241 CVE-2026-90243 CVE-2026-90259 CVE-2026-90263 CVE-2026-90265
CVE-2026-90292 CVE-2026-90293 CVE-2026-90294 CVE-2026-90307 CVE-2026-90308
CVE-2026-90309 CVE-2026-90358 CVE-2026-90388 CVE-2026-90413 CVE-2026-90414
CVE-2026-90415 CVE-2026-90417 CVE-2026-90426 CVE-2026-90428 CVE-2026-90430
CVE-2026-92495 CVE-2026-92523 CVE-2026-92525 CVE-2026-93037 CVE-2026-93107
CVE-2026-93108 CVE-2026-93109 CVE-2026-93110 CVE-2026-93154 CVE-2026-93160
CVE-2026-93207 CVE-2026-93212 CVE-2026-93264 CVE-2026-93782 CVE-2026-93794
CVE-2026-93800 CVE-2026-93810 CVE-2026-93814 CVE-2026-93825 CVE-2026-93826
CVE-2026-93827 CVE-2026-93829 CVE-2026-97413 CVE-2026-97421 CVE-2026-97477
CVE-2026-97520 CVE-2026-97521 CVE-2026-97543 CVE-2026-97544 CVE-2026-97545
CVE-2026-97546 CVE-2026-97552 CVE-2026-97557 CVE-2026-97571 CVE-2026-97572
CVE-2026-97573 CVE-2026-97574 CVE-2026-97605 CVE-2026-97902 CVE-2026-97934
CVE-2026-97940 CVE-2026-97947 CVE-2026-97957 CVE-2026-98003 CVE-2026-98028
CVE-2026-98029 CVE-2026-98030 CVE-2026-98091
-----------------------------------------------------------------
The container suse/sl-micro/6.2/kvm-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1899
Released: Mon Oct 12 10:05:58 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: important
References: 1211886,1243708,1263098,1282745,822653
This update for netcfg fixes the following issues:
Changes in netcfg:
- Don't replace /etc/services on updates (bsc#1282745)
- Add missing changes from factory:
* Add missing %verify(not mode) (bsc#1263098)
* services: remove invalid SIEVE entry (bsc#1243708, bsc#822653)
* Add krb-prop entry (bsc#1211886)
-----------------------------------------------------------------
Advisory ID: 1904
Released: Mon Oct 12 15:51:59 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1253340,1258335,1260474,1261564,1261816,1264330,1264607,1264747,1266410,1266848,1267464,1267672,1271817,1271901,1271950,1272145,1272215,1272347,1272388,1272473,1272571,1272802,1272803,1272890,1273040,1273059,1273116,1273258,1273275,1273290,1273297,1273320,1273491,1273512,1273784,1273879,1273889,1273938,1273970,1273976,1273982,1274037,1274061,1274245,1274297,1274298,1274316,1274319,1274538,1274629,1274663,1274776,1274818,1274824,1274836,1274890,1274912,1274920,1275137,1275142,1275170,1275495,1275543,1275545,1275549,1275559,1275567,1275682,1275740,1275924,1275953,1275972,1275977,1276007,1276009,1276262,1276287,1276295,1276337,1276338,1276340,1276345,1276347,1276349,1276352,1276353,1276388,1276460,1276461,1276462,1276474,1276475,1276504,1276508,1276519,1276532,1276535,1276538,1276563,1276565,1276570,1276573,1276579,1276783,1276852,1276921,1276923,1276927,1276930,1276947,1277030,1277032,1277036,1277098,1277101,1277109,1277122,1277128,1277129,1277143,1277149,1277153,1277215,1
277217,1277218,1277234,1277245,1277272,1277277,1277296,1277314,1277342,1277371,1277372,1277374,1277379,1277382,1277392,1277396,1277401,1277405,1277410,1277452,1277489,1277493,1277555,1277556,1277557,1277558,1277568,1277615,1277625,1277626,1277640,1277662,1277674,1277705,1277766,1277781,1277784,1277792,1277801,1277805,1277820,1277823,1277824,1277840,1277843,1277844,1277857,1277864,1277885,1277892,1277895,1277896,1277897,1277900,1277904,1277906,1277910,1277913,1277915,1278031,1278035,1278053,1278054,1278056,1278063,1278067,1278087,1278091,1278100,1278191,1278195,1278199,1278205,1278215,1278216,1278225,1278245,1278247,1278255,1278311,1278314,1278315,1278363,1278708,1279116,1279497,1279525,1279527,1279532,1279535,1279536,1279569,1279581,1279590,1279621,1279702,1279786,1279799,1279819,1279835,1279850,1279875,1279878,1279888,1280143,1280146,1280148,1280151,1280163,1280166,1280171,1280178,1280179,1280184,1280193,1280206,1280235,1280237,1280243,1280251,1280252,1280263,1280296,1280298,128029
9,1280303,1280309,1280333,1280334,1280335,1280336,1280338,1280350,1280375,1280379,1280383,1280384,1280387,1280388,1280449,1280451,1280455,1280456,1280464,1280468,1280477,1280487,1280488,1280490,1280494,1280508,1280509,1280518,1280525,1280544,1280546,1280548,1280551,1280576,1280577,1280711,1280716,1280717,1280719,1280720,1280726,1280727,1280733,1280758,1280761,1280766,1280786,1280797,1280870,1280872,1280901,1280920,1280923,1280969,1280985,1280993,1281010,1281014,1281025,1281054,1281057,1281077,1281085,1281136,1281201,1281202,1281224,1281226,1281228,1281229,1281231,1281273,1281295,1281379,1281387,1281399,1281408,1281496,1281514,1281525,1281546,1281597,1281599,1281644,1281645,1281660,1281680,1281682,1281683,1281717,1281732,1281738,1281754,1281777,1281778,1281786,1281789,1281795,1281808,1281825,1281845,1281922,1281955,1281956,1281964,1281973,1281991,1282003,1282013,1282020,1282050,1282054,1282072,1282104,1282110,1282113,1282143,1282147,1282197,1282270,1282271,1282288,1282648,1282672,128
2747,1282774,1282803,1282808,1282812,1282823,1282881,1282891,1282906,1282975,1282997,1283119,1283130,1283149,1283154,1283163,1283166,1283173,1283176,1283201,1283203,1283205,1283213,1283230,1283296,1283312,1283328,1283450,1283475,1283479,1283489,1283490,1283517,1283739,1283794,1283795,1283805,1283880,1283906,1283945,1284146,CVE-2025-40136,CVE-2026-100075,CVE-2026-23199,CVE-2026-23352,CVE-2026-43210,CVE-2026-43272,CVE-2026-43409,CVE-2026-45836,CVE-2026-46044,CVE-2026-46196,CVE-2026-46272,CVE-2026-53377,CVE-2026-53384,CVE-2026-63838,CVE-2026-63881,CVE-2026-63913,CVE-2026-63956,CVE-2026-63983,CVE-2026-64009,CVE-2026-64046,CVE-2026-64070,CVE-2026-64132,CVE-2026-64154,CVE-2026-64173,CVE-2026-64205,CVE-2026-64216,CVE-2026-64235,CVE-2026-64297,CVE-2026-64299,CVE-2026-64324,CVE-2026-64372,CVE-2026-64377,CVE-2026-64388,CVE-2026-64402,CVE-2026-64405,CVE-2026-64414,CVE-2026-64418,CVE-2026-64422,CVE-2026-64448,CVE-2026-64457,CVE-2026-64473,CVE-2026-64474,CVE-2026-64475,CVE-2026-64476,CVE-2026-64
580,CVE-2026-64594,CVE-2026-64597,CVE-2026-64598,CVE-2026-68146,CVE-2026-68162,CVE-2026-68264,CVE-2026-68266,CVE-2026-68290,CVE-2026-68312,CVE-2026-68343,CVE-2026-68367,CVE-2026-68376,CVE-2026-68382,CVE-2026-68385,CVE-2026-68400,CVE-2026-68441,CVE-2026-68451,CVE-2026-68452,CVE-2026-68454,CVE-2026-68471,CVE-2026-68477,CVE-2026-72012,CVE-2026-72018,CVE-2026-72025,CVE-2026-72066,CVE-2026-72070,CVE-2026-72098,CVE-2026-72102,CVE-2026-72128,CVE-2026-72129,CVE-2026-72130,CVE-2026-72147,CVE-2026-72166,CVE-2026-72218,CVE-2026-72219,CVE-2026-72224,CVE-2026-72237,CVE-2026-72247,CVE-2026-72256,CVE-2026-72299,CVE-2026-72321,CVE-2026-72322,CVE-2026-72348,CVE-2026-72349,CVE-2026-72351,CVE-2026-72352,CVE-2026-72383,CVE-2026-72392,CVE-2026-72404,CVE-2026-72406,CVE-2026-72413,CVE-2026-72433,CVE-2026-72434,CVE-2026-72435,CVE-2026-72436,CVE-2026-72444,CVE-2026-72447,CVE-2026-72491,CVE-2026-74256,CVE-2026-74257,CVE-2026-74258,CVE-2026-74267,CVE-2026-74268,CVE-2026-74281,CVE-2026-74283,CVE-2026-74288,CVE
-2026-74289,CVE-2026-74290,CVE-2026-74330,CVE-2026-74356,CVE-2026-74359,CVE-2026-74365,CVE-2026-74376,CVE-2026-74384,CVE-2026-74385,CVE-2026-74386,CVE-2026-74389,CVE-2026-74391,CVE-2026-74398,CVE-2026-74440,CVE-2026-74449,CVE-2026-74450,CVE-2026-74465,CVE-2026-74467,CVE-2026-74469,CVE-2026-74471,CVE-2026-74473,CVE-2026-74480,CVE-2026-74483,CVE-2026-74484,CVE-2026-74485,CVE-2026-74487,CVE-2026-74490,CVE-2026-74492,CVE-2026-74493,CVE-2026-74515,CVE-2026-74538,CVE-2026-74564,CVE-2026-74579,CVE-2026-74580,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74590,CVE-2026-74592,CVE-2026-74594,CVE-2026-74595,CVE-2026-74597,CVE-2026-74600,CVE-2026-74601,CVE-2026-74602,CVE-2026-74603,CVE-2026-74605,CVE-2026-74606,CVE-2026-74609,CVE-2026-74625,CVE-2026-74628,CVE-2026-74630,CVE-2026-74631,CVE-2026-74632,CVE-2026-74634,CVE-2026-74636,CVE-2026-74637,CVE-2026-74638,CVE-2026-74659,CVE-2026-74660,CVE-2026-74662,CVE-2026-74663,CVE-2026-74666,CVE-2026-74667,CVE-2026-74671,CVE-2026-74688,CVE-2026-7
4689,CVE-2026-74692,CVE-2026-74694,CVE-2026-74696,CVE-2026-74697,CVE-2026-74700,CVE-2026-74701,CVE-2026-74710,CVE-2026-74713,CVE-2026-74718,CVE-2026-74725,CVE-2026-74726,CVE-2026-74735,CVE-2026-74739,CVE-2026-74745,CVE-2026-74752,CVE-2026-80521,CVE-2026-80585,CVE-2026-80613,CVE-2026-80631,CVE-2026-80664,CVE-2026-80679,CVE-2026-80686,CVE-2026-80694,CVE-2026-80715,CVE-2026-80725,CVE-2026-80747,CVE-2026-80756,CVE-2026-80779,CVE-2026-80789,CVE-2026-80793,CVE-2026-80836,CVE-2026-80840,CVE-2026-80841,CVE-2026-80842,CVE-2026-80844,CVE-2026-80846,CVE-2026-80847,CVE-2026-80848,CVE-2026-80851,CVE-2026-80852,CVE-2026-80863,CVE-2026-80864,CVE-2026-80865,CVE-2026-80880,CVE-2026-80895,CVE-2026-80932,CVE-2026-80976,CVE-2026-80979,CVE-2026-80980,CVE-2026-80983,CVE-2026-80984,CVE-2026-81000,CVE-2026-81001,CVE-2026-89448,CVE-2026-89451,CVE-2026-89453,CVE-2026-89477,CVE-2026-89479,CVE-2026-89480,CVE-2026-89481,CVE-2026-89482,CVE-2026-89485,CVE-2026-89500,CVE-2026-89501,CVE-2026-89502,CVE-2026-89503,CV
E-2026-89508,CVE-2026-89510,CVE-2026-89511,CVE-2026-89525,CVE-2026-89526,CVE-2026-89527,CVE-2026-89530,CVE-2026-89531,CVE-2026-89532,CVE-2026-89533,CVE-2026-89534,CVE-2026-89535,CVE-2026-89536,CVE-2026-89538,CVE-2026-89539,CVE-2026-89540,CVE-2026-89541,CVE-2026-89542,CVE-2026-89544,CVE-2026-89545,CVE-2026-89547,CVE-2026-89548,CVE-2026-89550,CVE-2026-89551,CVE-2026-89564,CVE-2026-89569,CVE-2026-89580,CVE-2026-89603,CVE-2026-89644,CVE-2026-89658,CVE-2026-89660,CVE-2026-89662,CVE-2026-89663,CVE-2026-89665,CVE-2026-89669,CVE-2026-89671,CVE-2026-89672,CVE-2026-89673,CVE-2026-89674,CVE-2026-89680,CVE-2026-89683,CVE-2026-89684,CVE-2026-89685,CVE-2026-89686,CVE-2026-89688,CVE-2026-89690,CVE-2026-89691,CVE-2026-89694,CVE-2026-89696,CVE-2026-89697,CVE-2026-89698,CVE-2026-89699,CVE-2026-89702,CVE-2026-89703,CVE-2026-89704,CVE-2026-89705,CVE-2026-89706,CVE-2026-89707,CVE-2026-89710,CVE-2026-89712,CVE-2026-89713,CVE-2026-89747,CVE-2026-89780,CVE-2026-89784,CVE-2026-89789,CVE-2026-89791,CVE-2026-
89798,CVE-2026-89912,CVE-2026-89913,CVE-2026-89968,CVE-2026-89970,CVE-2026-89984,CVE-2026-90003,CVE-2026-90065,CVE-2026-90074,CVE-2026-90097,CVE-2026-90101,CVE-2026-90104,CVE-2026-90142,CVE-2026-90149,CVE-2026-90150,CVE-2026-90151,CVE-2026-90177,CVE-2026-90182,CVE-2026-90183,CVE-2026-90203,CVE-2026-90218,CVE-2026-90228,CVE-2026-90240,CVE-2026-90241,CVE-2026-90243,CVE-2026-90259,CVE-2026-90263,CVE-2026-90265,CVE-2026-90292,CVE-2026-90293,CVE-2026-90294,CVE-2026-90307,CVE-2026-90308,CVE-2026-90309,CVE-2026-90358,CVE-2026-90388,CVE-2026-90413,CVE-2026-90414,CVE-2026-90415,CVE-2026-90417,CVE-2026-90426,CVE-2026-90428,CVE-2026-90430,CVE-2026-92495,CVE-2026-92523,CVE-2026-92525,CVE-2026-93037,CVE-2026-93107,CVE-2026-93108,CVE-2026-93109,CVE-2026-93110,CVE-2026-93154,CVE-2026-93160,CVE-2026-93207,CVE-2026-93212,CVE-2026-93264,CVE-2026-93782,CVE-2026-93794,CVE-2026-93800,CVE-2026-93810,CVE-2026-93814,CVE-2026-93825,CVE-2026-93826,CVE-2026-93827,CVE-2026-93829,CVE-2026-97413,CVE-2026-97421,C
VE-2026-97477,CVE-2026-97520,CVE-2026-97521,CVE-2026-97543,CVE-2026-97544,CVE-2026-97545,CVE-2026-97546,CVE-2026-97552,CVE-2026-97557,CVE-2026-97571,CVE-2026-97572,CVE-2026-97573,CVE-2026-97574,CVE-2026-97605,CVE-2026-97902,CVE-2026-97934,CVE-2026-97940,CVE-2026-97947,CVE-2026-97957,CVE-2026-98003,CVE-2026-98028,CVE-2026-98029,CVE-2026-98030,CVE-2026-98091
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
(bsc#1272890).
- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
- CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).
- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).
- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).
- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).
- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).
- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).
- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).
- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).
- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).
- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).
- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).
- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).
- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).
- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).
- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).
- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).
- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).
- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).
- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).
- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).
- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).
- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).
- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).
- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
- CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c (bsc#1276947).
- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).
- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).
- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).
- CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).
- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).
- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).
- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).
- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).
- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).
- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).
- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).
- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).
- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).
- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).
- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).
- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).
- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).
- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).
- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).
- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).
- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).
- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).
- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).
- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).
- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).
- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).
- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).
- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).
- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).
- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).
- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).
- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).
- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).
- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).
- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).
- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).
- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).
- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).
- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).
- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).
- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).
- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).
- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).
- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).
- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).
- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).
- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).
- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).
- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).
- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).
- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).
- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).
- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).
- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).
- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).
- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).
- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).
- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).
- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
- CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383).
- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).
- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).
- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).
- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).
- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).
- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).
- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).
- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).
- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).
- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).
- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).
- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).
- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).
- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).
- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).
- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).
- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).
- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).
- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).
- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).
- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).
- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).
- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).
- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).
- CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252).
- CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235).
- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).
- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).
- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).
- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).
- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).
- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).
- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).
- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).
- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).
- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).
- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).
- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).
- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).
- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).
- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).
- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).
- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).
- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).
- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).
- CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames (bsc#1280969).
- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).
- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).
- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).
- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).
- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).
- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).
- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).
- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).
- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).
- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).
- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).
- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).
- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).
- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).
- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).
- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).
- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).
- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).
- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).
- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).
- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).
- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).
- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).
- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).
- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).
- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).
- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).
- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).
- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).
- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).
- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).
- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).
- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).
- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).
- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).
- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.
- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().
- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).
- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).
- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).
- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).
- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).
- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).
- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).
- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).
- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).
- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).
- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).
- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).
- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).
- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).
- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).
- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).
- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).
- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).
- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).
- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).
- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).
- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).
- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).
- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).
- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).
- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).
- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).
- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).
- ACPICA: add boundary checks in two places (stable-fixes).
- ACPICA: Add package limit checks in parser functions (stable-fixes).
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).
- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).
- ACPICA: Prevent adding invalid references (stable-fixes).
- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).
- ACPICA: validate handler object type in two places (stable-fixes).
- ALSA: 6fire: Clean ups with guard() (stable-fixes).
- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).
- ALSA: aloop: Check card index validity at probe (stable-fixes).
- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).
- ALSA: caiaq: unregister the input device when probe fails (git-fixes).
- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).
- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).
- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).
- ALSA: es18xx: check control allocation before private data setup (stable-fixes).
- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).
- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).
- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).
- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).
- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).
- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).
- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).
- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).
- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).
- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).
- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).
- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).
- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).
- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).
- ALSA: line6: reject oversized playback packets (git-fixes).
- ALSA: mpu401: Check card index validity at probe (stable-fixes).
- ALSA: mts64: Check card index validity at probe (stable-fixes).
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).
- ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes).
- ALSA: portman2x4: Check card index validity at probe (stable-fixes).
- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).
- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).
- ALSA: seq: Serialize compat port-info ioctls (git-fixes).
- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).
- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).
- ALSA: ump: Copy FB name string more safely (stable-fixes).
- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).
- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).
- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).
- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).
- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).
- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).
- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).
- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).
- ALSA: virmidi: Check card index validity at probe (stable-fixes).
- ALSA: virtio: reset device before deleting virtqueues (git-fixes).
- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).
- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).
- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).
- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
- arm64: percpu: Fix this_cpu_write() casting (git-fixes).
- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).
- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).
- ASoC: codecs: aw88261: reduce log spam (stable-fixes).
- ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).
- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).
- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (git-fixes).
- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).
- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).
- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).
- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).
- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).
- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).
- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).
- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).
- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).
- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).
- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).
- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).
- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).
- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).
- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).
- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).
- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).
- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).
- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).
- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).
- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).
- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).
- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).
- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).
- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).
- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).
- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).
- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).
- Bluetooth: eir: validate service data length before reading UUID (git-fixes).
- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).
- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).
- Bluetooth: hci_core: Print number of packets in conn->data_q (stable-fixes).
- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).
- Bluetooth: hci_sock: validate event length before filtering (git-fixes).
- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).
- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).
- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).
- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).
- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).
- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).
- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).
- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes).
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).
- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).
- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).
- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).
- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).
- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).
- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).
- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).
- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).
- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).
- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default
configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
- dmaengine: Add devm_dma_request_chan() (stable-fixes).
- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).
- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).
- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).
- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).
- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).
- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).
- driver core: Export get_dev_from_fwnode() (stable-fixes).
- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).
- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).
- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).
- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).
- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).
- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).
- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).
- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).
- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).
- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).
- drm/amdgpu: check ras and obj before dereference (git-fixes).
- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).
- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).
- drm/amdgpu: Failed to check various return code (stable-fixes).
- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).
- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).
- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).
- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).
- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).
- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).
- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).
- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).
- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).
- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).
- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes).
- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).
- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).
- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).
- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).
- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).
- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).
- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).
- drm/cirrus: Use video aperture helpers (stable-fixes).
- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).
- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).
- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).
- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).
- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).
- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).
- drm/i915: fix incorrect RCU teardown order (git-fixes).
- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).
- drm/imagination: clamp freelist reconstruction requests (git-fixes).
- drm/imagination: Fix page count for page table for map() interface (git-fixes).
- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).
- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).
- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).
- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).
- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).
- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).
- drm/msm: Recover HW before retire hung submit (git-fixes).
- drm/nouveau/bios: skip the IFR header if present (stable-fixes).
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).
- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).
- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).
- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).
- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).
- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).
- drm/omap: dsi: Do not copy isr table (git-fixes).
- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).
- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).
- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).
- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).
- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).
- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).
- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).
- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).
- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).
- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).
- drm: add drm_memory_stats_is_zero (stable-fixes).
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).
- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).
- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).
- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).
- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).
- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).
- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).
- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).
- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).
- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).
- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).
- gpio: tps65219: Fix GPIO input value reads (git-fixes).
- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).
- gpio: zynq: fix runtime PM leak on request error path (git-fixes).
- HID: alps: fix use-after-free on input2 registration failure (git-fixes).
- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).
- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).
- HID: asus: fortify keyboard handshake (stable-fixes).
- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).
- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).
- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).
- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).
- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).
- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).
- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).
- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).
- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).
- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).
- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).
- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).
- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).
- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).
- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).
- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).
- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).
- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).
- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).
- hwmon: (w83793) release probe data through kref (git-fixes).
- i2c: at91: release DMA channels on remove and probe error (git-fixes).
- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).
- i2c: imx: disable autosuspend on remove (git-fixes).
- i2c: imx: release DMA channels on probe error (git-fixes).
- i2c: mxs: fix DMA channel leak on probe error (git-fixes).
- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).
- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).
- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).
- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).
- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).
- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).
- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).
- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).
- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).
- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).
- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).
- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).
- iio: accel: sca3000: fix frequency divider condition check (git-fixes).
- iio: adc: pac1934: check ACPI label duplication (git-fixes).
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).
- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).
- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).
- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).
- iio: buffer: serialize buffer teardown with mode claims (git-fixes).
- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).
- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).
- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).
- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).
- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).
- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).
- iio: proximity: aw96103: validate firmware data length (git-fixes).
- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).
- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).
- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).
- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).
- Input: aiptek - validate raw macro indices before updating state (stable-fixes).
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).
- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).
- Input: eeti_ts - publish the OF module alias (git-fixes).
- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).
- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).
- Input: soc_button_array - check btns_desc->package.count (git-fixes).
- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).
- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).
- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).
- Input: xpad - add support for Azeron devices (stable-fixes).
- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).
- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).
- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).
- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.
- kernel-binary.spec.in: Fix syntax error.
- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).
- keys: fix lost wakeup when reaping a dead key type (git-fixes).
- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).
- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).
- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).
- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).
- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).
- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).
- KVM: nVMX: Always flush vpid02 on first use (git-fixes).
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).
- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).
- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).
- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).
- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).
- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).
- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).
- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).
- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).
- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).
- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).
- media: i2c: imx355: Replace client->dev usage (stable-fixes).
- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).
- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).
- media: qcom: camss: avoid format string warning (stable-fixes).
- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).
- media: video-i2c: fix buffer queue ordering (stable-fixes).
- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).
- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).
- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).
- mfd: rsmu: Add 8a34002 support (stable-fixes).
- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).
- mmc: core: Add validation for host-provided max_segs (stable-fixes).
- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).
- mmc: core: Fix OF node reference leak on card add failure (git-fixes).
- mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes).
- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).
- mmc: hsq: Fix use-after-free in retry work (git-fixes).
- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).
- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).
- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).
- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).
- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).
- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).
- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).
- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).
- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).
- mtd: core: call _get_device() with the master MTD (git-fixes).
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).
- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).
- mtd: rawnand: pl353: Fix debug prints (git-fixes).
- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).
- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).
- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).
- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).
- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).
- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).
- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).
- net: usb: sr9700: include receive overhead in the length check (git-fixes).
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).
- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).
- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).
- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).
- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).
- nfc: nfcmrvl: validate helper command length before pull (git-fixes).
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).
- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).
- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).
- nfc: st21nfca: validate received frame size (git-fixes).
- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).
- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).
- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).
- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).
- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).
- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).
- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).
- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).
- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).
- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).
- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).
- PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes).
- PCI: xgene: Drop unnecessary OF node reference (git-fixes).
- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).
- pinctrl: meson: Fix typo in s4 group name (git-fixes).
- pinctrl: single: free the IRQ on domain creation failure (git-fixes).
- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).
- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).
- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).
- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).
- platform/x86: ISST: Validate max level for set feature (git-fixes).
- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).
- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).
- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).
- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).
- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).
- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).
- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).
- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).
- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).
- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).
- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).
- powerpc: Add Power12 architected mode (jsc#PED-16906).
- powerpc: Add Power12 raw mode (jsc#PED-16906).
- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).
- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
- RDMA/core: Fix potential use after free in counter_release() (git-fixes).
- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).
- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).
- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).
- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).
- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).
- RDMA/hfi1: Create workqueues before device initialization (git-fixes).
- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).
- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).
- RDMA/hfi1: Free RX data on late probe failure (git-fixes).
- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).
- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).
- RDMA/hfi1: Preserve unit 0 on (git-fixes).
- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).
- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).
- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).
- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).
- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).
- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).
- RDMA/rvt: Return NULL after port allocation failure (git-fixes).
- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).
- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).
- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).
- rtc: ac100: Assign .num before accessing .hws (git-fixes).
- rtc: aspeed: add AST2700 compatible (stable-fixes).
- rtc: bq32000: add delay between RTC reads (stable-fixes).
- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).
- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).
- rtc: mv: add suspend/resume support for wakeup (stable-fixes).
- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).
- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).
- serial: 8250: fix possible ISR soft lockup (stable-fixes).
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).
- serial: fix TIOCMIWAIT race (git-fixes).
- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).
- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).
- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).
- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).
- soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes).
- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).
- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).
- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).
- soundwire: only handle alert events when the peripheral is attached (stable-fixes).
- soundwire: validate DT compatible before parsing it (stable-fixes).
- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).
- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).
- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).
- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).
- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).
- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).
- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).
- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).
- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).
- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).
- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).
- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).
- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).
- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).
- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).
- thunderbolt: Reject oversized XDomain properties responses (git-fixes).
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).
- thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes).
- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).
- tpm: Disable TPM on null key name mismatch (git-fixes).
- tty: serial: max3100: shut down timer before freeing port (git-fixes).
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).
- tty: vt: fix memory leak in vc_allocate() (git-fixes).
- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).
- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).
- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).
- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).
- usb: cdns3: rename hibernated argument of role->resume() to lost_power (stable-fixes).
- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).
- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).
- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).
- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).
- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes).
- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).
- usb: gadget: udc: skip pullup() if already connected (stable-fixes).
- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).
- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).
- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).
- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).
- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).
- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).
- usb: ohci-st: disable controller wakeup on removal (git-fixes).
- USB: serial: fix driver deregistration order (git-fixes).
- USB: serial: fix dynamic id driver deregistration race (git-fixes).
- USB: serial: fix ioctl hangup race (git-fixes).
- USB: serial: fix port tear down use-after-free (git-fixes).
- USB: serial: quatech2: fix baud rate overflow (git-fixes).
- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).
- USB: serial: ssu100: fix baud rate overflow (git-fixes).
- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).
- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).
- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).
- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).
- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).
- usb: usbtmc: don't store usb_device_id (stable-fixes).
- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).
- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).
- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).
- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).
- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).
- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: digicolor: Avoid division by zero (git-fixes).
- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).
- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).
- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).
- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).
- watchdog: msc313e: Propagate error code in resume() (git-fixes).
- watchdog: rtd119x: Avoid division by zero (git-fixes).
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).
- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).
- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).
- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).
- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).
- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).
- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).
- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).
- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).
- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).
- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).
- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).
- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).
- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).
- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).
- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).
- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).
- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).
- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).
- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).
- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).
- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).
- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).
- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).
- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).
- wifi: libertas: reject short monitor TX frames (stable-fixes).
- wifi: libipw: fix key index receive bound checks (stable-fixes).
- wifi: libipw: reject too-short association responses (git-fixes).
- wifi: libipw: reject too-short beacon and probe responses (git-fixes).
- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).
- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).
- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).
- wifi: mac80211: don't access the TSF of a down interface (git-fixes).
- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).
- wifi: mac80211: don't allow link changes when iface is down (git-fixes).
- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).
- wifi: mac80211: don't start a ROC while scanning (git-fixes).
- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).
- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).
- wifi: mac80211: mesh: release the channel if start fails (git-fixes).
- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).
- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).
- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).
- wifi: mac80211: reset state when starting AP fails (git-fixes).
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).
- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).
- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).
- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).
- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).
- wifi: mt76: add init_wiphy callback (stable-fixes).
- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).
- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).
- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).
- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).
- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).
- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).
- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).
- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).
- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).
- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).
- wifi: mwifiex: validate action frame fixed fields (git-fixes).
- wifi: mwifiex: validate scan response extents (git-fixes).
- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).
- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).
- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).
- wifi: rsi: fix heap OOB write on key removal (git-fixes).
- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).
- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes).
- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).
- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).
- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).
- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).
- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).
- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).
- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).
- wifi: virt_wifi: don't transfer operstate before register (git-fixes).
- wifi: virt_wifi: free skb when disconnected (git-fixes).
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).
- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).
- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).
The following package changes have been done:
- netcfg-11.6-160000.4.1 updated
- kernel-default-base-6.12.0-160000.39.1.160000.2.28 updated
- container:suse-sl-micro-6.2-base-os-container-latest-16adea2fc90b42c8d75eb50a9b67640c7878537c4a442f882bed834cde7ce40f-0 updated
More information about the sle-container-updates
mailing list