SUSE-CU-2026:12389-1: Security update of elemental/base-os-kernel-default
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Oct 17 07:28:20 UTC 2026
SUSE Container Update Advisory: elemental/base-os-kernel-default
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12389-1
Container Tags : elemental/base-os-kernel-default:16.0 , elemental/base-os-kernel-default:16.0-4.25
Container Release : 4.25
Severity : critical
Type : security
References : 1149651 1185845 1191256 1191270 1194778 1204315 1205462 1205462
1205588 1207184 1214285 1214285 1215199 1215199 1215199 1216378
1217845 1218459 1218644 1218644 1221126 1222465 1222768 1228081
1228659 1228728 1230062 1231986 1232226 1232234 1234634 1234634
1234634 1234634 1234693 1234765 1234863 1234959 1235463 1235905
1235953 1236282 1236344 1236743 1236897 1237108 1237131 1237449
1237515 1237542 1237776 1238472 1238972 1239206 1239206 1240324
1240696 1240890 1240957 1240966 1240998 1241166 1241166 1241259
1241353 1241403 1241435 1241637 1242034 1242086 1242414 1242505
1242782 1242864 1242965 1242974 1242986 1242995 1243000 1243055
1243068 1243100 1243112 1243112 1243208 1243452 1243474 1243507
1243603 1243603 1243603 1243662 1243774 1244309 1244449 1244723
1244734 1244749 1244792 1244812 1244930 1244939 1245000 1245151
1245193 1245193 1245193 1245206 1245216 1245260 1245410 1245431
1245457 1245498 1245499 1245504 1245506 1245508 1245510 1245524
1245551 1245596 1245621 1245630 1245636 1245654 1245657 1245658
1245659 1245663 1245664 1245665 1245666 1245668 1245669 1245670
1245671 1245675 1245676 1245678 1245683 1245684 1245686 1245688
1245690 1245691 1245695 1245700 1245703 1245705 1245710 1245711
1245713 1245714 1245715 1245717 1245719 1245721 1245723 1245726
1245728 1245729 1245730 1245731 1245735 1245737 1245738 1245744
1245745 1245746 1245747 1245748 1245749 1245751 1245757 1245763
1245765 1245767 1245769 1245777 1245780 1245781 1245784 1245785
1245787 1245812 1245814 1245815 1245937 1245945 1245952 1245953
1245955 1245956 1245963 1245966 1245970 1245973 1245976 1245977
1245986 1246000 1246002 1246005 1246008 1246012 1246013 1246022
1246023 1246031 1246034 1246037 1246041 1246042 1246047 1246049
1246050 1246053 1246054 1246055 1246057 1246098 1246109 1246125
1246166 1246171 1246176 1246179 1246181 1246182 1246183 1246184
1246185 1246186 1246188 1246190 1246192 1246193 1246195 1246220
1246231 1246234 1246236 1246240 1246243 1246244 1246245 1246246
1246248 1246250 1246252 1246253 1246255 1246258 1246259 1246260
1246262 1246266 1246268 1246282 1246283 1246285 1246286 1246287
1246290 1246292 1246293 1246295 1246297 1246328 1246333 1246334
1246337 1246342 1246349 1246351 1246353 1246354 1246358 1246364
1246366 1246370 1246375 1246376 1246385 1246386 1246387 1246438
1246443 1246444 1246447 1246450 1246453 1246473 1246490 1246509
1246547 1246631 1246651 1246688 1246777 1246781 1246782 1246843
1246868 1246896 1246911 1246979 1247018 1247020 1247022 1247023
1247024 1247027 1247028 1247030 1247031 1247033 1247035 1247061
1247062 1247064 1247076 1247078 1247079 1247088 1247089 1247091
1247097 1247098 1247099 1247101 1247102 1247103 1247104 1247112
1247113 1247116 1247118 1247119 1247123 1247125 1247126 1247128
1247130 1247131 1247132 1247136 1247137 1247138 1247141 1247143
1247145 1247146 1247147 1247149 1247150 1247151 1247152 1247153
1247154 1247155 1247156 1247157 1247160 1247162 1247163 1247164
1247167 1247169 1247170 1247171 1247174 1247176 1247177 1247178
1247181 1247209 1247210 1247220 1247222 1247223 1247227 1247229
1247231 1247233 1247234 1247235 1247236 1247238 1247239 1247241
1247242 1247243 1247250 1247251 1247252 1247253 1247255 1247262
1247265 1247270 1247271 1247273 1247274 1247276 1247277 1247278
1247279 1247280 1247282 1247283 1247284 1247285 1247288 1247289
1247290 1247292 1247293 1247308 1247311 1247313 1247314 1247317
1247325 1247347 1247348 1247349 1247366 1247372 1247376 1247426
1247432 1247437 1247442 1247455 1247483 1247500 1247500 1247500
1247712 1247712 1247837 1247838 1247850 1247858 1247935 1247936
1247949 1247950 1247963 1247976 1248088 1248111 1248121 1248166
1248175 1248178 1248179 1248183 1248185 1248186 1248188 1248190
1248192 1248194 1248196 1248198 1248199 1248200 1248202 1248205
1248206 1248208 1248209 1248211 1248211 1248212 1248213 1248214
1248216 1248217 1248222 1248223 1248224 1248225 1248227 1248228
1248229 1248230 1248232 1248234 1248235 1248240 1248255 1248261
1248296 1248297 1248299 1248302 1248304 1248306 1248312 1248333
1248334 1248337 1248338 1248340 1248341 1248343 1248345 1248349
1248350 1248354 1248355 1248356 1248357 1248359 1248360 1248361
1248363 1248365 1248366 1248367 1248368 1248374 1248377 1248378
1248380 1248384 1248386 1248390 1248392 1248395 1248396 1248399
1248401 1248480 1248501 1248511 1248512 1248516 1248573 1248575
1248577 1248609 1248610 1248611 1248616 1248617 1248619 1248621
1248622 1248624 1248626 1248627 1248628 1248630 1248634 1248635
1248639 1248643 1248647 1248648 1248652 1248655 1248662 1248664
1248666 1248669 1248674 1248681 1248727 1248728 1248748 1248754
1248754 1248775 1248792 1248842 1249022 1249038 1249060 1249061
1249062 1249064 1249065 1249066 1249088 1249104 1249104 1249126
1249143 1249156 1249159 1249160 1249161 1249163 1249164 1249166
1249167 1249169 1249170 1249172 1249176 1249177 1249182 1249186
1249190 1249193 1249195 1249199 1249201 1249202 1249203 1249204
1249206 1249215 1249220 1249221 1249226 1249254 1249256 1249258
1249262 1249263 1249265 1249266 1249269 1249271 1249272 1249273
1249274 1249278 1249279 1249281 1249282 1249284 1249285 1249286
1249288 1249290 1249292 1249295 1249296 1249297 1249299 1249300
1249301 1249302 1249303 1249304 1249305 1249306 1249307 1249308
1249309 1249312 1249313 1249314 1249315 1249316 1249317 1249318
1249319 1249320 1249321 1249322 1249323 1249324 1249333 1249334
1249338 1249346 1249374 1249385 1249397 1249397 1249398 1249413
1249477 1249478 1249479 1249486 1249490 1249494 1249495 1249500
1249504 1249506 1249508 1249509 1249510 1249512 1249513 1249515
1249516 1249522 1249523 1249524 1249526 1249533 1249538 1249540
1249542 1249545 1249547 1249548 1249550 1249552 1249554 1249562
1249566 1249587 1249590 1249598 1249604 1249608 1249608 1249609
1249615 1249618 1249735 1249774 1249833 1249887 1249888 1249895
1249901 1249904 1249906 1249912 1249915 1249974 1249975 1249977
1249982 1249998 1250002 1250007 1250021 1250025 1250028 1250032
1250032 1250034 1250082 1250087 1250088 1250119 1250123 1250124
1250176 1250177 1250179 1250202 1250203 1250204 1250205 1250232
1250233 1250234 1250237 1250237 1250242 1250247 1250249 1250251
1250252 1250258 1250262 1250266 1250267 1250268 1250275 1250276
1250281 1250291 1250292 1250294 1250296 1250297 1250298 1250334
1250344 1250365 1250371 1250377 1250379 1250386 1250388 1250388
1250389 1250398 1250400 1250402 1250406 1250407 1250408 1250450
1250455 1250491 1250491 1250519 1250522 1250553 1250650 1250655
1250655 1250664 1250671 1250702 1250704 1250705 1250705 1250711
1250712 1250713 1250716 1250719 1250721 1250722 1250723 1250729
1250736 1250737 1250738 1250739 1250741 1250742 1250746 1250748
1250748 1250749 1250758 1250946 1250951 1250952 1251100 1251114
1251120 1251134 1251135 1251135 1251143 1251146 1251176 1251177
1251186 1251216 1251230 1251232 1251233 1251804 1251809 1251810
1251817 1251819 1251930 1251948 1251966 1251966 1251967 1251971
1251981 1252008 1252033 1252035 1252039 1252044 1252046 1252047
1252051 1252052 1252054 1252056 1252060 1252062 1252063 1252064
1252065 1252067 1252069 1252070 1252072 1252073 1252074 1252075
1252076 1252078 1252079 1252081 1252082 1252083 1252084 1252148
1252253 1252265 1252266 1252267 1252270 1252301 1252303 1252306
1252330 1252333 1252336 1252342 1252346 1252348 1252349 1252352
1252357 1252678 1252679 1252681 1252682 1252686 1252688 1252696
1252712 1252725 1252734 1252763 1252772 1252773 1252774 1252776
1252779 1252780 1252784 1252785 1252787 1252789 1252790 1252794
1252795 1252797 1252808 1252809 1252817 1252819 1252821 1252822
1252824 1252826 1252836 1252841 1252845 1252848 1252849 1252850
1252851 1252854 1252858 1252861 1252862 1252865 1252866 1252873
1252891 1252900 1252901 1252902 1252909 1252911 1252912 1252915
1252917 1252918 1252919 1252921 1252923 1252924 1252928 1252930
1252931 1252932 1252933 1252934 1252935 1252939 1253018 1253025
1253043 1253049 1253078 1253079 1253087 1253129 1253129 1253139
1253155 1253155 1253176 1253238 1253238 1253262 1253262 1253275
1253318 1253324 1253328 1253330 1253340 1253342 1253344 1253348
1253349 1253352 1253355 1253360 1253362 1253363 1253365 1253367
1253369 1253386 1253394 1253395 1253400 1253402 1253403 1253405
1253407 1253408 1253409 1253410 1253412 1253413 1253414 1253416
1253421 1253422 1253423 1253424 1253425 1253426 1253427 1253428
1253431 1253433 1253434 1253436 1253438 1253440 1253441 1253442
1253443 1253445 1253448 1253449 1253450 1253451 1253453 1253454
1253455 1253456 1253457 1253458 1253463 1253471 1253472 1253500
1253622 1253623 1253624 1253635 1253643 1253647 1253674 1253679
1253691 1253739 1253739 1254119 1254126 1254128 1254157 1254158
1254159 1254160 1254181 1254195 1254214 1254221 1254244 1254244
1254264 1254299 1254306 1254306 1254307 1254308 1254308 1254315
1254336 1254363 1254378 1254408 1254415 1254447 1254477 1254480
1254510 1254518 1254518 1254519 1254520 1254563 1254615 1254616
1254618 1254621 1254624 1254666 1254679 1254791 1254793 1254794
1254795 1254796 1254797 1254798 1254808 1254809 1254813 1254815
1254817 1254821 1254824 1254825 1254827 1254828 1254829 1254830
1254832 1254835 1254839 1254840 1254842 1254843 1254845 1254846
1254847 1254849 1254850 1254851 1254852 1254854 1254856 1254858
1254860 1254861 1254864 1254868 1254869 1254871 1254894 1254924
1254924 1254928 1254928 1254957 1254959 1254961 1254964 1254977
1254996 1255026 1255029 1255030 1255034 1255035 1255039 1255040
1255041 1255042 1255057 1255058 1255064 1255065 1255068 1255071
1255072 1255075 1255077 1255081 1255082 1255083 1255084 1255087
1255092 1255094 1255095 1255097 1255099 1255102 1255103 1255116
1255120 1255121 1255122 1255124 1255128 1255129 1255131 1255134
1255135 1255136 1255138 1255140 1255142 1255144 1255145 1255146
1255148 1255149 1255150 1255152 1255154 1255155 1255156 1255157
1255160 1255161 1255164 1255167 1255169 1255171 1255172 1255175
1255179 1255181 1255182 1255186 1255187 1255190 1255193 1255196
1255197 1255199 1255202 1255203 1255206 1255209 1255216 1255218
1255220 1255221 1255223 1255224 1255225 1255226 1255227 1255228
1255230 1255231 1255232 1255233 1255234 1255241 1255242 1255243
1255245 1255246 1255247 1255250 1255251 1255252 1255253 1255255
1255256 1255259 1255260 1255261 1255262 1255266 1255268 1255269
1255272 1255273 1255274 1255276 1255279 1255297 1255311 1255312
1255316 1255318 1255319 1255325 1255326 1255326 1255327 1255329
1255346 1255346 1255349 1255351 1255354 1255357 1255360 1255377
1255379 1255380 1255395 1255401 1255403 1255415 1255417 1255428
1255433 1255434 1255441 1255459 1255459 1255480 1255482 1255483
1255488 1255489 1255490 1255493 1255495 1255505 1255506 1255507
1255508 1255509 1255526 1255527 1255529 1255530 1255531 1255533
1255536 1255537 1255541 1255542 1255544 1255547 1255550 1255552
1255553 1255567 1255569 1255572 1255580 1255593 1255601 1255603
1255611 1255614 1255622 1255672 1255687 1255687 1255688 1255694
1255695 1255698 1255703 1255706 1255707 1255708 1255709 1255721
1255722 1255723 1255724 1255752 1255811 1255812 1255813 1255814
1255816 1255868 1255930 1255931 1255932 1255934 1255943 1255944
1256238 1256288 1256341 1256427 1256436 1256466 1256495 1256525
1256526 1256579 1256582 1256584 1256586 1256591 1256592 1256593
1256594 1256597 1256605 1256606 1256607 1256608 1256609 1256610
1256611 1256612 1256613 1256616 1256617 1256619 1256622 1256623
1256625 1256627 1256628 1256629 1256630 1256632 1256638 1256640
1256641 1256643 1256645 1256646 1256647 1256650 1256651 1256653
1256654 1256655 1256656 1256659 1256660 1256661 1256664 1256665
1256667 1256668 1256671 1256674 1256675 1256677 1256679 1256680
1256682 1256683 1256688 1256689 1256708 1256716 1256726 1256728
1256730 1256732 1256733 1256737 1256741 1256742 1256744 1256748
1256749 1256752 1256754 1256755 1256756 1256757 1256759 1256760
1256761 1256763 1256766 1256770 1256773 1256774 1256777 1256779
1256781 1256784 1256785 1256792 1256793 1256794 1256794 1256802
1256804 1256805 1256807 1256808 1256809 1256810 1256811 1256812
1256822 1256829 1256830 1256831 1256832 1256833 1256834 1256835
1256836 1256837 1256838 1256839 1256840 1256864 1256865 1256865
1256865 1256867 1256867 1256867 1256975 1257005 1257015 1257035
1257053 1257055 1257154 1257154 1257155 1257158 1257159 1257163
1257164 1257167 1257168 1257174 1257179 1257180 1257183 1257202
1257204 1257207 1257208 1257209 1257215 1257217 1257218 1257220
1257221 1257222 1257225 1257227 1257228 1257231 1257232 1257234
1257236 1257243 1257245 1257246 1257274 1257276 1257277 1257279
1257282 1257296 1257309 1257332 1257364 1257365 1257463 1257463
1257466 1257472 1257473 1257473 1257504 1257506 1257511 1257551
1257552 1257553 1257554 1257556 1257557 1257559 1257560 1257561
1257562 1257565 1257570 1257572 1257573 1257576 1257579 1257580
1257581 1257586 1257593 1257594 1257595 1257600 1257603 1257631
1257635 1257661 1257679 1257682 1257686 1257687 1257688 1257704
1257705 1257706 1257707 1257708 1257709 1257714 1257715 1257716
1257718 1257721 1257722 1257723 1257726 1257729 1257730 1257732
1257734 1257735 1257737 1257739 1257740 1257741 1257742 1257743
1257745 1257749 1257750 1257755 1257757 1257758 1257759 1257761
1257762 1257763 1257765 1257768 1257770 1257772 1257773 1257775
1257776 1257777 1257777 1257788 1257789 1257790 1257805 1257808
1257809 1257811 1257813 1257814 1257815 1257816 1257817 1257818
1257830 1257942 1257952 1258020 1258022 1258153 1258175 1258181
1258184 1258222 1258232 1258234 1258237 1258245 1258249 1258252
1258256 1258258 1258259 1258272 1258273 1258276 1258277 1258278
1258279 1258280 1258286 1258289 1258290 1258293 1258297 1258298
1258299 1258301 1258303 1258304 1258305 1258308 1258309 1258311
1258313 1258317 1258319 1258321 1258323 1258324 1258326 1258330
1258331 1258335 1258337 1258338 1258340 1258344 1258349 1258354
1258355 1258358 1258374 1258376 1258377 1258379 1258389 1258392
1258394 1258395 1258397 1258411 1258414 1258415 1258419 1258421
1258422 1258424 1258429 1258430 1258442 1258447 1258455 1258461
1258464 1258465 1258468 1258469 1258472 1258476 1258483 1258484
1258489 1258517 1258518 1258518 1258519 1258520 1258524 1258538
1258544 1258660 1258672 1258718 1258718 1258824 1258826 1258849
1258849 1258850 1258854 1258855 1258856 1258857 1258859 1258933
1258961 1259071 1259118 1259132 1259186 1259188 1259199 1259215
1259222 1259329 1259329 1259418 1259418 1259420 1259461 1259461
1259484 1259485 1259535 1259543 1259580 1259650 1259650 1259652
1259652 1259672 1259697 1259707 1259759 1259762 1259764 1259795
1259797 1259799 1259800 1259806 1259825 1259857 1259865 1259866
1259868 1259869 1259870 1259871 1259873 1259878 1259884 1259886
1259889 1259891 1259924 1259955 1259955 1259994 1259997 1259998
1260005 1260009 1260010 1260012 1260012 1260018 1260078 1260082
1260347 1260347 1260357 1260428 1260441 1260442 1260443 1260444
1260445 1260459 1260464 1260468 1260471 1260474 1260481 1260483
1260484 1260485 1260486 1260489 1260490 1260497 1260500 1260501
1260502 1260504 1260505 1260507 1260514 1260522 1260523 1260526
1260527 1260528 1260529 1260530 1260531 1260532 1260533 1260536
1260537 1260538 1260539 1260541 1260544 1260546 1260548 1260549
1260550 1260551 1260552 1260553 1260555 1260561 1260562 1260565
1260566 1260571 1260572 1260573 1260576 1260577 1260580 1260581
1260584 1260593 1260593 1260606 1260613 1260728 1260729 1260730
1260731 1260732 1260735 1260754 1260755 1260798 1260799 1260800
1260801 1260807 1260811 1260996 1261020 1261041 1261149 1261206
1261250 1261250 1261256 1261280 1261287 1261288 1261295 1261348
1261400 1261410 1261496 1261498 1261503 1261504 1261505 1261506
1261507 1261550 1261555 1261562 1261562 1261564 1261581 1261582
1261584 1261585 1261590 1261590 1261592 1261601 1261602 1261603
1261604 1261606 1261606 1261617 1261618 1261619 1261629 1261632
1261635 1261636 1261637 1261638 1261639 1261641 1261644 1261645
1261648 1261669 1261678 1261679 1261685 1261686 1261687 1261692
1261694 1261700 1261702 1261703 1261707 1261710 1261713 1261714
1261719 1261738 1261750 1261751 1261752 1261768 1261778 1261779
1261780 1261781 1261786 1261788 1261789 1261791 1261796 1261797
1261809 1261816 1261896 1261957 1261982 1261983 1262019 1262053
1262054 1262055 1262061 1262063 1262073 1262074 1262078 1262085
1262086 1262087 1262099 1262100 1262101 1262144 1262160 1262179
1262181 1262245 1262250 1262305 1262315 1262391 1262392 1262430
1262464 1262465 1262480 1262573 1262573 1262601 1262602 1262603
1262605 1262606 1262614 1262615 1262616 1262617 1262618 1262619
1262620 1262622 1262624 1262627 1262634 1262637 1262639 1262640
1262652 1262653 1262655 1262656 1262658 1262659 1262662 1262663
1262665 1262668 1262671 1262673 1262674 1262678 1262679 1262684
1262693 1262709 1262719 1262723 1262725 1262731 1262734 1262745
1262746 1262748 1262750 1262751 1262752 1262754 1262755 1262756
1262757 1262758 1262765 1262768 1262770 1262771 1262771 1262798
1262992 1262993 1263001 1263004 1263006 1263008 1263010 1263011
1263012 1263013 1263014 1263016 1263017 1263018 1263020 1263025
1263030 1263031 1263044 1263045 1263048 1263052 1263055 1263057
1263058 1263059 1263061 1263062 1263064 1263065 1263067 1263068
1263072 1263073 1263074 1263075 1263077 1263078 1263085 1263093
1263095 1263097 1263102 1263104 1263107 1263111 1263115 1263117
1263122 1263123 1263124 1263128 1263130 1263131 1263133 1263134
1263135 1263137 1263138 1263139 1263140 1263141 1263142 1263143
1263145 1263152 1263165 1263167 1263169 1263169 1263170 1263173
1263175 1263176 1263178 1263180 1263255 1263319 1263491 1263493
1263495 1263539 1263556 1263560 1263562 1263563 1263568 1263573
1263578 1263579 1263581 1263582 1263588 1263591 1263592 1263593
1263594 1263595 1263596 1263598 1263600 1263604 1263656 1263657
1263658 1263668 1263718 1263723 1263724 1263769 1263774 1263776
1263777 1263778 1263780 1263782 1263785 1263786 1263788 1263790
1263794 1263796 1263797 1263806 1263815 1263864 1263865 1263876
1263879 1263880 1263882 1263883 1263901 1263904 1263905 1263908
1263911 1263917 1263918 1263919 1263921 1263923 1263930 1263931
1263932 1263933 1263934 1263942 1263945 1263975 1263993 1263995
1263996 1263998 1263999 1264000 1264001 1264003 1264006 1264007
1264008 1264009 1264010 1264011 1264012 1264013 1264013 1264014
1264014 1264015 1264016 1264019 1264030 1264032 1264033 1264035
1264039 1264040 1264041 1264044 1264045 1264048 1264053 1264056
1264059 1264063 1264065 1264067 1264070 1264071 1264073 1264074
1264075 1264076 1264079 1264080 1264082 1264084 1264084 1264087
1264088 1264089 1264090 1264091 1264093 1264097 1264100 1264101
1264110 1264112 1264116 1264117 1264121 1264122 1264124 1264125
1264129 1264137 1264142 1264145 1264183 1264184 1264188 1264189
1264190 1264196 1264197 1264228 1264230 1264231 1264233 1264235
1264236 1264237 1264239 1264241 1264243 1264245 1264247 1264250
1264254 1264255 1264257 1264258 1264261 1264263 1264266 1264267
1264267 1264270 1264286 1264294 1264295 1264296 1264300 1264302
1264303 1264304 1264308 1264313 1264317 1264319 1264320 1264321
1264322 1264328 1264330 1264331 1264333 1264335 1264336 1264337
1264338 1264339 1264340 1264365 1264372 1264377 1264379 1264386
1264386 1264387 1264388 1264409 1264414 1264415 1264416 1264417
1264418 1264419 1264422 1264423 1264424 1264425 1264427 1264429
1264430 1264431 1264436 1264437 1264442 1264444 1264446 1264449
1264449 1264450 1264451 1264452 1264469 1264473 1264475 1264476
1264477 1264479 1264480 1264482 1264484 1264520 1264526 1264530
1264531 1264532 1264534 1264537 1264538 1264539 1264540 1264541
1264543 1264544 1264545 1264548 1264549 1264551 1264553 1264556
1264558 1264560 1264561 1264562 1264564 1264566 1264580 1264584
1264586 1264587 1264590 1264592 1264594 1264595 1264598 1264600
1264601 1264603 1264607 1264609 1264610 1264612 1264613 1264614
1264615 1264616 1264618 1264619 1264620 1264622 1264624 1264626
1264630 1264631 1264633 1264634 1264637 1264640 1264642 1264643
1264644 1264645 1264646 1264647 1264649 1264651 1264668 1264669
1264671 1264672 1264674 1264677 1264678 1264712 1264716 1264719
1264720 1264722 1264723 1264725 1264726 1264731 1264734 1264739
1264740 1264741 1264744 1264746 1264747 1264748 1264758 1264763
1264765 1264768 1264779 1264780 1264781 1264782 1264783 1264785
1264788 1264789 1264790 1264791 1264793 1264794 1264795 1264801
1264803 1264805 1264807 1264809 1264815 1264816 1264819 1264821
1264822 1264826 1264827 1264830 1264832 1264837 1264844 1264848
1264851 1264852 1264974 1264978 1264982 1264987 1264988 1264989
1264991 1264993 1264997 1265000 1265005 1265009 1265019 1265020
1265023 1265032 1265035 1265036 1265037 1265041 1265044 1265046
1265047 1265054 1265058 1265068 1265073 1265074 1265078 1265079
1265080 1265081 1265082 1265084 1265085 1265086 1265089 1265090
1265091 1265092 1265093 1265096 1265097 1265100 1265101 1265102
1265103 1265105 1265110 1265112 1265113 1265114 1265116 1265119
1265121 1265122 1265123 1265126 1265128 1265129 1265132 1265133
1265138 1265141 1265142 1265143 1265144 1265144 1265170 1265186
1265209 1265220 1265240 1265247 1265249 1265251 1265254 1265257
1265264 1265308 1265308 1265421 1265449 1265449 1265456 1265579
1265626 1265627 1265628 1265629 1265846 1265925 1265928 1265928
1265960 1265999 1266000 1266001 1266008 1266009 1266214 1266238
1266283 1266284 1266290 1266304 1266307 1266340 1266341 1266342
1266343 1266344 1266345 1266347 1266349 1266350 1266351 1266352
1266353 1266355 1266356 1266357 1266361 1266390 1266393 1266394
1266395 1266396 1266397 1266398 1266399 1266400 1266402 1266402
1266410 1266411 1266412 1266414 1266452 1266458 1266467 1266468
1266470 1266677 1266679 1266684 1266685 1266686 1266688 1266690
1266692 1266693 1266694 1266695 1266696 1266697 1266698 1266700
1266703 1266704 1266705 1266706 1266707 1266710 1266711 1266712
1266714 1266715 1266716 1266717 1266718 1266720 1266721 1266722
1266726 1266729 1266730 1266732 1266734 1266735 1266736 1266739
1266740 1266741 1266743 1266744 1266750 1266751 1266754 1266755
1266757 1266758 1266759 1266761 1266762 1266765 1266767 1266773
1266774 1266775 1266780 1266786 1266805 1266806 1266810 1266813
1266816 1266826 1266827 1266830 1266831 1266832 1266834 1266835
1266836 1266838 1266839 1266840 1266841 1266842 1266846 1266847
1266848 1266850 1266854 1266855 1266858 1266860 1266863 1266864
1266869 1266870 1266872 1266874 1266876 1266878 1266879 1266880
1266882 1266883 1266886 1266888 1266889 1266890 1266891 1266892
1266893 1266894 1266895 1266896 1266897 1266898 1266899 1266900
1266901 1266903 1266904 1266908 1266910 1266913 1266914 1266916
1266917 1266918 1266920 1266922 1266925 1266927 1266928 1266929
1266930 1266931 1266932 1266933 1266934 1266935 1266939 1266947
1266969 1266972 1267021 1267023 1267025 1267027 1267198 1267203
1267204 1267205 1267208 1267209 1267210 1267213 1267214 1267218
1267220 1267222 1267226 1267228 1267234 1267236 1267238 1267238
1267251 1267251 1267360 1267361 1267365 1267367 1267369 1267371
1267373 1267375 1267380 1267381 1267384 1267387 1267419 1267419
1267427 1267431 1267432 1267435 1267436 1267437 1267439 1267445
1267448 1267449 1267458 1267464 1267466 1267468 1267470 1267472
1267473 1267479 1267491 1267493 1267495 1267496 1267497 1267501
1267502 1267505 1267524 1267531 1267548 1267555 1267565 1267567
1267570 1267571 1267582 1267583 1267584 1267586 1267591 1267592
1267594 1267595 1267596 1267597 1267600 1267600 1267611 1267612
1267615 1267616 1267618 1267621 1267623 1267624 1267626 1267627
1267628 1267629 1267630 1267632 1267635 1267636 1267637 1267638
1267640 1267643 1267644 1267646 1267647 1267648 1267649 1267651
1267652 1267654 1267656 1267657 1267658 1267659 1267661 1267662
1267663 1267666 1267667 1267669 1267672 1267673 1267676 1267677
1267678 1267680 1267682 1267682 1267683 1267684 1267685 1267689
1267690 1267691 1267693 1267697 1267701 1267702 1267704 1267712
1267714 1267715 1267717 1267719 1267722 1267725 1267726 1267728
1267732 1267738 1267744 1267816 1267824 1267825 1267875 1267882
1267918 1267919 1267922 1267927 1267932 1267937 1267939 1267943
1267948 1267952 1267953 1267954 1267966 1267968 1267983 1267985
1267986 1267987 1267990 1267991 1267992 1267993 1267994 1267995
1268018 1268022 1268024 1268029 1268030 1268031 1268037 1268038
1268051 1268220 1268221 1268222 1268223 1268237 1268238 1268276
1268290 1268307 1268307 1268335 1268349 1268428 1268659 1268660
1268661 1268747 1268867 1268886 1268966 1268967 1268972 1268979
1268981 1268983 1268985 1268987 1268989 1268994 1269000 1269001
1269002 1269003 1269004 1269010 1269013 1269022 1269024 1269025
1269027 1269030 1269031 1269033 1269036 1269081 1269084 1269087
1269090 1269092 1269094 1269095 1269098 1269100 1269103 1269104
1269106 1269107 1269108 1269111 1269112 1269113 1269114 1269115
1269116 1269117 1269118 1269119 1269124 1269125 1269126 1269131
1269132 1269133 1269134 1269135 1269136 1269137 1269138 1269140
1269141 1269150 1269151 1269153 1269154 1269157 1269158 1269159
1269162 1269164 1269166 1269167 1269170 1269172 1269174 1269175
1269177 1269178 1269181 1269184 1269185 1269186 1269187 1269188
1269190 1269193 1269195 1269198 1269199 1269227 1269229 1269230
1269232 1269233 1269234 1269235 1269236 1269238 1269239 1269240
1269241 1269242 1269244 1269245 1269252 1269254 1269255 1269256
1269257 1269258 1269262 1269270 1269272 1269273 1269281 1269283
1269286 1269288 1269289 1269290 1269301 1269304 1269306 1269307
1269310 1269314 1269318 1269337 1269362 1269364 1269376 1269378
1269380 1269381 1269383 1269385 1269386 1269388 1269389 1269391
1269392 1269397 1269398 1269402 1269403 1269404 1269410 1269412
1269414 1269415 1269416 1269417 1269418 1269493 1269505 1269506
1269511 1269512 1269513 1269519 1269527 1269528 1269530 1269531
1269532 1269537 1269556 1269557 1269571 1269574 1269577 1269579
1269583 1269584 1269587 1269588 1269590 1269617 1269622 1269623
1269633 1269635 1269637 1269643 1269644 1269645 1269646 1269647
1269651 1269652 1269654 1269655 1269658 1269659 1269660 1269661
1269663 1269665 1269669 1269670 1269672 1269674 1269675 1269677
1269678 1269680 1269681 1269682 1269684 1269685 1269686 1269687
1269688 1269689 1269690 1269691 1269694 1269695 1269697 1269700
1269708 1269709 1269710 1269711 1269712 1269713 1269714 1269719
1269722 1269724 1269726 1269727 1269731 1269733 1269734 1269768
1269770 1269772 1269773 1269774 1269783 1269786 1269790 1269792
1269795 1269796 1269797 1269798 1269799 1269801 1269808 1269809
1269810 1269811 1269814 1269815 1269816 1269817 1269819 1269821
1269826 1269877 1269879 1269884 1269886 1269888 1269889 1269898
1269899 1269902 1269904 1269950 1269961 1269964 1269965 1269969
1269973 1269976 1269979 1269982 1269984 1269985 1269986 1269988
1269989 1269990 1269991 1269992 1269993 1269994 1269995 1269996
1269997 1269998 1269999 1270000 1270022 1270042 1270058 1270059
1270059 1270090 1270102 1270108 1270111 1270112 1270113 1270132
1270139 1270219 1270226 1270241 1270244 1270248 1270249 1270251
1270257 1270260 1270266 1270267 1270302 1270439 1271045 1271050
1271256 1271290 1271291 1271349 1271351 1271352 1271354 1271365
1271366 1271366 1271368 1271372 1271386 1271395 1271444 1271526
1271602 1271712 1271717 1271731 1271813 1271817 1271818 1271820
1271825 1271825 1271826 1271827 1271830 1271831 1271832 1271833
1271834 1271835 1271858 1271859 1271866 1271869 1271870 1271899
1271901 1271904 1271906 1271908 1271912 1271937 1271950 1271955
1271964 1271967 1271980 1272145 1272146 1272148 1272149 1272150
1272175 1272176 1272179 1272180 1272182 1272183 1272184 1272187
1272194 1272197 1272199 1272200 1272204 1272207 1272210 1272211
1272213 1272215 1272230 1272242 1272246 1272260 1272261 1272262
1272263 1272268 1272282 1272284 1272287 1272296 1272297 1272346
1272347 1272359 1272360 1272361 1272362 1272366 1272373 1272374
1272380 1272381 1272383 1272384 1272385 1272387 1272388 1272389
1272390 1272406 1272422 1272423 1272426 1272429 1272434 1272462
1272466 1272467 1272468 1272470 1272471 1272472 1272473 1272474
1272478 1272480 1272482 1272483 1272484 1272486 1272489 1272492
1272494 1272497 1272499 1272500 1272501 1272502 1272504 1272505
1272513 1272514 1272516 1272517 1272522 1272523 1272524 1272554
1272568 1272568 1272569 1272571 1272572 1272573 1272578 1272584
1272591 1272607 1272610 1272612 1272613 1272614 1272616 1272617
1272618 1272620 1272641 1272642 1272643 1272646 1272659 1272662
1272664 1272665 1272668 1272670 1272671 1272673 1272675 1272678
1272680 1272681 1272682 1272685 1272686 1272689 1272690 1272691
1272693 1272694 1272706 1272756 1272781 1272785 1272786 1272787
1272788 1272791 1272797 1272798 1272799 1272800 1272802 1272803
1272804 1272807 1272836 1272843 1272847 1272848 1272850 1272853
1272855 1272858 1272863 1272865 1272867 1272868 1272869 1272871
1272877 1272890 1272891 1272891 1272892 1272893 1272894 1272897
1272903 1272904 1272905 1272907 1272918 1272920 1272963 1272969
1272971 1272973 1272983 1272985 1272993 1273005 1273008 1273019
1273023 1273027 1273030 1273032 1273033 1273035 1273036 1273037
1273038 1273040 1273044 1273053 1273054 1273059 1273060 1273105
1273107 1273116 1273117 1273119 1273134 1273231 1273231 1273249
1273251 1273258 1273260 1273271 1273273 1273274 1273275 1273276
1273277 1273280 1273281 1273283 1273284 1273285 1273286 1273288
1273289 1273290 1273291 1273294 1273297 1273302 1273303 1273305
1273309 1273310 1273311 1273312 1273314 1273316 1273317 1273318
1273319 1273320 1273323 1273325 1273327 1273331 1273334 1273335
1273336 1273337 1273338 1273339 1273340 1273341 1273346 1273420
1273422 1273426 1273443 1273460 1273461 1273463 1273465 1273468
1273469 1273471 1273479 1273480 1273482 1273484 1273486 1273488
1273490 1273491 1273495 1273501 1273503 1273504 1273506 1273507
1273509 1273511 1273512 1273520 1273523 1273524 1273525 1273533
1273536 1273538 1273542 1273550 1273555 1273557 1273567 1273578
1273579 1273581 1273582 1273596 1273597 1273598 1273600 1273601
1273602 1273603 1273679 1273681 1273682 1273734 1273737 1273738
1273739 1273740 1273741 1273742 1273743 1273744 1273745 1273746
1273748 1273749 1273755 1273759 1273762 1273765 1273766 1273769
1273770 1273774 1273776 1273778 1273780 1273782 1273784 1273788
1273790 1273796 1273797 1273801 1273803 1273804 1273809 1273810
1273811 1273812 1273813 1273817 1273822 1273824 1273831 1273834
1273838 1273839 1273842 1273844 1273848 1273849 1273852 1273855
1273859 1273860 1273862 1273864 1273866 1273867 1273868 1273869
1273870 1273872 1273876 1273877 1273879 1273880 1273882 1273889
1273890 1273891 1273892 1273895 1273896 1273898 1273899 1273903
1273904 1273905 1273930 1273933 1273934 1273935 1273936 1273938
1273939 1273940 1273941 1273942 1273944 1273945 1273946 1273947
1273949 1273953 1273954 1273956 1273957 1273958 1273959 1273963
1273966 1273967 1273968 1273970 1273972 1273974 1273975 1273976
1273977 1273982 1273988 1273990 1273991 1273995 1273997 1273999
1274001 1274003 1274006 1274008 1274009 1274010 1274011 1274012
1274014 1274017 1274019 1274020 1274026 1274028 1274030 1274031
1274035 1274036 1274037 1274040 1274041 1274052 1274055 1274057
1274058 1274060 1274061 1274063 1274065 1274067 1274071 1274072
1274075 1274076 1274077 1274078 1274208 1274226 1274239 1274243
1274245 1274252 1274253 1274258 1274264 1274265 1274267 1274274
1274277 1274278 1274281 1274283 1274286 1274290 1274292 1274294
1274295 1274296 1274297 1274298 1274314 1274316 1274319 1274321
1274491 1274492 1274494 1274497 1274538 1274539 1274541 1274543
1274545 1274547 1274550 1274556 1274573 1274578 1274580 1274581
1274622 1274624 1274628 1274629 1274632 1274636 1274637 1274639
1274640 1274642 1274644 1274645 1274646 1274650 1274651 1274652
1274656 1274657 1274659 1274662 1274663 1274665 1274667 1274669
1274670 1274671 1274675 1274677 1274678 1274679 1274681 1274682
1274690 1274694 1274696 1274698 1274699 1274700 1274702 1274703
1274705 1274706 1274707 1274709 1274710 1274713 1274716 1274721
1274723 1274725 1274726 1274727 1274730 1274737 1274738 1274749
1274750 1274751 1274752 1274753 1274754 1274755 1274756 1274764
1274768 1274770 1274771 1274773 1274774 1274776 1274777 1274782
1274783 1274787 1274788 1274790 1274791 1274792 1274795 1274796
1274797 1274798 1274800 1274801 1274802 1274803 1274804 1274805
1274807 1274808 1274811 1274813 1274814 1274818 1274824 1274831
1274834 1274835 1274836 1274838 1274847 1274849 1274853 1274868
1274869 1274872 1274873 1274874 1274876 1274877 1274879 1274881
1274883 1274886 1274887 1274888 1274890 1274891 1274892 1274893
1274894 1274895 1274896 1274897 1274898 1274899 1274900 1274901
1274902 1274904 1274905 1274906 1274907 1274908 1274912 1274913
1274914 1274920 1274921 1274924 1274925 1274927 1274929 1274930
1274933 1274934 1274935 1274938 1274939 1274940 1274941 1274945
1274947 1274951 1274952 1274953 1274955 1274957 1274958 1274965
1274968 1274978 1274981 1275040 1275045 1275069 1275071 1275072
1275073 1275076 1275080 1275081 1275083 1275088 1275091 1275092
1275094 1275125 1275126 1275129 1275131 1275132 1275137 1275139
1275141 1275142 1275146 1275148 1275149 1275150 1275152 1275154
1275155 1275156 1275157 1275158 1275160 1275161 1275163 1275164
1275169 1275170 1275173 1275176 1275185 1275190 1275192 1275229
1275236 1275237 1275238 1275239 1275294 1275300 1275301 1275303
1275304 1275305 1275306 1275307 1275441 1275470 1275474 1275479
1275481 1275483 1275486 1275487 1275495 1275496 1275506 1275509
1275511 1275514 1275517 1275519 1275528 1275535 1275540 1275543
1275545 1275549 1275553 1275555 1275557 1275559 1275561 1275566
1275567 1275569 1275572 1275574 1275578 1275582 1275583 1275584
1275587 1275588 1275591 1275595 1275596 1275633 1275636 1275650
1275655 1275656 1275659 1275665 1275669 1275672 1275679 1275682
1275685 1275687 1275688 1275690 1275695 1275696 1275704 1275737
1275740 1275782 1275784 1275787 1275788 1275789 1275790 1275798
1275799 1275801 1275802 1275804 1275805 1275812 1275817 1275818
1275819 1275820 1275821 1275822 1275823 1275827 1275837 1275864
1275866 1275867 1275869 1275870 1275871 1275872 1275886 1275905
1275923 1275924 1275925 1275928 1275950 1275953 1275954 1275956
1275970 1275972 1275973 1275975 1275976 1275977 1275985 1276006
1276007 1276009 1276029 1276257 1276258 1276262 1276263 1276265
1276267 1276270 1276273 1276277 1276287 1276295 1276333 1276335
1276337 1276338 1276339 1276340 1276341 1276345 1276346 1276347
1276349 1276352 1276353 1276354 1276355 1276381 1276388 1276395
1276446 1276452 1276460 1276461 1276462 1276468 1276471 1276473
1276474 1276475 1276500 1276504 1276507 1276508 1276512 1276519
1276528 1276532 1276535 1276538 1276542 1276546 1276547 1276551
1276552 1276553 1276561 1276562 1276563 1276565 1276566 1276569
1276570 1276572 1276573 1276577 1276579 1276586 1276665 1276766
1276767 1276771 1276783 1276785 1276793 1276801 1276803 1276814
1276818 1276821 1276831 1276840 1276852 1276864 1276865 1276866
1276870 1276876 1276880 1276892 1276905 1276913 1276921 1276922
1276923 1276927 1276930 1276931 1276937 1276941 1276946 1276947
1276955 1276957 1276961 1277022 1277023 1277030 1277032 1277033
1277034 1277036 1277037 1277047 1277054 1277057 1277059 1277062
1277066 1277069 1277070 1277077 1277078 1277092 1277095 1277098
1277101 1277108 1277109 1277114 1277115 1277118 1277120 1277122
1277128 1277129 1277143 1277149 1277153 1277155 1277159 1277160
1277202 1277204 1277215 1277217 1277218 1277227 1277229 1277230
1277231 1277233 1277234 1277245 1277247 1277249 1277254 1277262
1277265 1277268 1277272 1277275 1277277 1277285 1277296 1277308
1277311 1277314 1277315 1277321 1277328 1277335 1277342 1277349
1277350 1277371 1277372 1277374 1277379 1277382 1277391 1277392
1277396 1277401 1277405 1277407 1277408 1277410 1277452 1277485
1277489 1277493 1277505 1277513 1277551 1277553 1277555 1277556
1277557 1277558 1277561 1277568 1277574 1277615 1277625 1277626
1277636 1277640 1277641 1277649 1277655 1277656 1277660 1277662
1277668 1277674 1277680 1277688 1277705 1277707 1277708 1277709
1277710 1277711 1277712 1277713 1277726 1277728 1277738 1277748
1277761 1277764 1277766 1277773 1277775 1277776 1277781 1277782
1277783 1277784 1277792 1277801 1277805 1277813 1277818 1277820
1277822 1277823 1277824 1277840 1277843 1277844 1277845 1277857
1277862 1277864 1277874 1277876 1277885 1277892 1277895 1277896
1277897 1277898 1277900 1277901 1277904 1277906 1277908 1277910
1277913 1277915 1277918 1277919 1277921 1277922 1278031 1278035
1278039 1278053 1278054 1278056 1278063 1278067 1278070 1278087
1278088 1278091 1278094 1278098 1278100 1278113 1278155 1278180
1278191 1278195 1278199 1278205 1278215 1278216 1278225 1278233
1278236 1278240 1278245 1278247 1278253 1278255 1278293 1278311
1278314 1278315 1278324 1278331 1278334 1278347 1278348 1278349
1278363 1278395 1278416 1278703 1278708 1278716 1278729 1278733
1279116 1279487 1279497 1279525 1279527 1279532 1279535 1279536
1279537 1279569 1279580 1279581 1279590 1279621 1279702 1279786
1279799 1279813 1279819 1279835 1279842 1279847 1279850 1279875
1279878 1279887 1279888 1279893 1280049 1280050 1280051 1280052
1280053 1280054 1280139 1280143 1280146 1280148 1280151 1280163
1280166 1280171 1280178 1280179 1280184 1280193 1280206 1280235
1280237 1280243 1280251 1280252 1280263 1280296 1280298 1280299
1280303 1280309 1280333 1280334 1280335 1280336 1280338 1280350
1280375 1280379 1280383 1280384 1280387 1280388 1280449 1280451
1280455 1280456 1280464 1280468 1280477 1280487 1280488 1280490
1280494 1280508 1280509 1280518 1280525 1280544 1280546 1280548
1280551 1280576 1280577 1280587 1280589 1280590 1280591 1280592
1280594 1280595 1280596 1280597 1280598 1280599 1280711 1280716
1280717 1280719 1280720 1280726 1280727 1280733 1280758 1280761
1280766 1280786 1280797 1280870 1280872 1280901 1280920 1280923
1280969 1280985 1280993 1281010 1281014 1281025 1281054 1281057
1281077 1281085 1281136 1281201 1281202 1281224 1281226 1281228
1281229 1281231 1281273 1281295 1281297 1281379 1281387 1281399
1281408 1281496 1281514 1281525 1281546 1281597 1281599 1281644
1281645 1281660 1281680 1281682 1281683 1281717 1281732 1281738
1281754 1281777 1281778 1281786 1281789 1281795 1281808 1281825
1281845 1281922 1281955 1281956 1281964 1281973 1281991 1282003
1282013 1282020 1282050 1282054 1282072 1282104 1282110 1282113
1282143 1282147 1282197 1282270 1282271 1282288 1282301 1282509
1282648 1282672 1282747 1282774 1282803 1282808 1282812 1282823
1282881 1282891 1282906 1282975 1282997 1283119 1283130 1283149
1283154 1283163 1283166 1283173 1283176 1283183 1283201 1283203
1283205 1283213 1283230 1283296 1283312 1283328 1283450 1283475
1283479 1283489 1283490 1283517 1283739 1283794 1283795 1283805
1283880 1283906 1283945 1284146 CVE-2022-50253 CVE-2023-20585
CVE-2023-20585 CVE-2023-20585 CVE-2023-45853 CVE-2024-10041 CVE-2024-14027
CVE-2024-2236 CVE-2024-2312 CVE-2024-53164 CVE-2024-54031 CVE-2024-56738
CVE-2024-57891 CVE-2024-57951 CVE-2024-57952 CVE-2024-58090 CVE-2025-0395
CVE-2025-10263 CVE-2025-10911 CVE-2025-11187 CVE-2025-13151 CVE-2025-14104
CVE-2025-15281 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-15649
CVE-2025-21816 CVE-2025-22034 CVE-2025-22077 CVE-2025-23141 CVE-2025-28162
CVE-2025-28164 CVE-2025-37744 CVE-2025-37751 CVE-2025-37798 CVE-2025-37821
CVE-2025-37841 CVE-2025-37845 CVE-2025-37849 CVE-2025-37856 CVE-2025-37861
CVE-2025-37864 CVE-2025-37904 CVE-2025-37916 CVE-2025-37955 CVE-2025-38006
CVE-2025-38008 CVE-2025-38019 CVE-2025-38034 CVE-2025-38038 CVE-2025-38052
CVE-2025-38058 CVE-2025-38062 CVE-2025-38075 CVE-2025-38084 CVE-2025-38085
CVE-2025-38087 CVE-2025-38088 CVE-2025-38089 CVE-2025-38090 CVE-2025-38091
CVE-2025-38095 CVE-2025-38096 CVE-2025-38098 CVE-2025-38099 CVE-2025-38101
CVE-2025-38102 CVE-2025-38103 CVE-2025-38106 CVE-2025-38107 CVE-2025-38108
CVE-2025-38109 CVE-2025-38110 CVE-2025-38111 CVE-2025-38112 CVE-2025-38113
CVE-2025-38114 CVE-2025-38117 CVE-2025-38118 CVE-2025-38119 CVE-2025-38120
CVE-2025-38122 CVE-2025-38123 CVE-2025-38124 CVE-2025-38125 CVE-2025-38127
CVE-2025-38128 CVE-2025-38129 CVE-2025-38134 CVE-2025-38135 CVE-2025-38136
CVE-2025-38137 CVE-2025-38138 CVE-2025-38140 CVE-2025-38141 CVE-2025-38142
CVE-2025-38143 CVE-2025-38145 CVE-2025-38146 CVE-2025-38148 CVE-2025-38149
CVE-2025-38151 CVE-2025-38153 CVE-2025-38154 CVE-2025-38155 CVE-2025-38156
CVE-2025-38157 CVE-2025-38159 CVE-2025-38160 CVE-2025-38161 CVE-2025-38165
CVE-2025-38168 CVE-2025-38169 CVE-2025-38170 CVE-2025-38172 CVE-2025-38173
CVE-2025-38174 CVE-2025-38177 CVE-2025-38180 CVE-2025-38181 CVE-2025-38182
CVE-2025-38184 CVE-2025-38185 CVE-2025-38186 CVE-2025-38188 CVE-2025-38189
CVE-2025-38190 CVE-2025-38193 CVE-2025-38197 CVE-2025-38198 CVE-2025-38201
CVE-2025-38205 CVE-2025-38208 CVE-2025-38209 CVE-2025-38211 CVE-2025-38213
CVE-2025-38214 CVE-2025-38215 CVE-2025-38216 CVE-2025-38217 CVE-2025-38220
CVE-2025-38222 CVE-2025-38224 CVE-2025-38225 CVE-2025-38226 CVE-2025-38227
CVE-2025-38228 CVE-2025-38229 CVE-2025-38231 CVE-2025-38232 CVE-2025-38233
CVE-2025-38234 CVE-2025-38238 CVE-2025-38242 CVE-2025-38243 CVE-2025-38244
CVE-2025-38245 CVE-2025-38246 CVE-2025-38249 CVE-2025-38250 CVE-2025-38251
CVE-2025-38253 CVE-2025-38255 CVE-2025-38256 CVE-2025-38257 CVE-2025-38258
CVE-2025-38259 CVE-2025-38262 CVE-2025-38263 CVE-2025-38264 CVE-2025-38265
CVE-2025-38267 CVE-2025-38268 CVE-2025-38270 CVE-2025-38272 CVE-2025-38273
CVE-2025-38274 CVE-2025-38275 CVE-2025-38277 CVE-2025-38278 CVE-2025-38286
CVE-2025-38287 CVE-2025-38288 CVE-2025-38289 CVE-2025-38290 CVE-2025-38291
CVE-2025-38292 CVE-2025-38293 CVE-2025-38297 CVE-2025-38298 CVE-2025-38299
CVE-2025-38300 CVE-2025-38301 CVE-2025-38302 CVE-2025-38303 CVE-2025-38304
CVE-2025-38305 CVE-2025-38306 CVE-2025-38307 CVE-2025-38311 CVE-2025-38312
CVE-2025-38313 CVE-2025-38315 CVE-2025-38317 CVE-2025-38318 CVE-2025-38319
CVE-2025-38321 CVE-2025-38322 CVE-2025-38323 CVE-2025-38326 CVE-2025-38332
CVE-2025-38335 CVE-2025-38336 CVE-2025-38337 CVE-2025-38338 CVE-2025-38339
CVE-2025-38341 CVE-2025-38342 CVE-2025-38343 CVE-2025-38344 CVE-2025-38345
CVE-2025-38348 CVE-2025-38349 CVE-2025-38350 CVE-2025-38351 CVE-2025-38352
CVE-2025-38353 CVE-2025-38354 CVE-2025-38355 CVE-2025-38356 CVE-2025-38359
CVE-2025-38360 CVE-2025-38361 CVE-2025-38362 CVE-2025-38363 CVE-2025-38364
CVE-2025-38365 CVE-2025-38368 CVE-2025-38369 CVE-2025-38371 CVE-2025-38372
CVE-2025-38373 CVE-2025-38374 CVE-2025-38375 CVE-2025-38376 CVE-2025-38377
CVE-2025-38379 CVE-2025-38380 CVE-2025-38381 CVE-2025-38382 CVE-2025-38383
CVE-2025-38384 CVE-2025-38385 CVE-2025-38386 CVE-2025-38387 CVE-2025-38389
CVE-2025-38390 CVE-2025-38391 CVE-2025-38392 CVE-2025-38393 CVE-2025-38395
CVE-2025-38396 CVE-2025-38397 CVE-2025-38399 CVE-2025-38400 CVE-2025-38401
CVE-2025-38402 CVE-2025-38403 CVE-2025-38404 CVE-2025-38405 CVE-2025-38406
CVE-2025-38408 CVE-2025-38409 CVE-2025-38410 CVE-2025-38412 CVE-2025-38413
CVE-2025-38414 CVE-2025-38415 CVE-2025-38416 CVE-2025-38417 CVE-2025-38418
CVE-2025-38419 CVE-2025-38420 CVE-2025-38421 CVE-2025-38423 CVE-2025-38424
CVE-2025-38425 CVE-2025-38426 CVE-2025-38427 CVE-2025-38428 CVE-2025-38429
CVE-2025-38430 CVE-2025-38436 CVE-2025-38438 CVE-2025-38439 CVE-2025-38440
CVE-2025-38441 CVE-2025-38443 CVE-2025-38444 CVE-2025-38445 CVE-2025-38446
CVE-2025-38448 CVE-2025-38449 CVE-2025-38450 CVE-2025-38451 CVE-2025-38453
CVE-2025-38454 CVE-2025-38455 CVE-2025-38456 CVE-2025-38457 CVE-2025-38458
CVE-2025-38459 CVE-2025-38460 CVE-2025-38461 CVE-2025-38462 CVE-2025-38463
CVE-2025-38464 CVE-2025-38465 CVE-2025-38466 CVE-2025-38467 CVE-2025-38468
CVE-2025-38469 CVE-2025-38470 CVE-2025-38472 CVE-2025-38473 CVE-2025-38474
CVE-2025-38475 CVE-2025-38476 CVE-2025-38477 CVE-2025-38478 CVE-2025-38480
CVE-2025-38481 CVE-2025-38482 CVE-2025-38483 CVE-2025-38484 CVE-2025-38485
CVE-2025-38487 CVE-2025-38488 CVE-2025-38489 CVE-2025-38490 CVE-2025-38491
CVE-2025-38493 CVE-2025-38494 CVE-2025-38495 CVE-2025-38496 CVE-2025-38497
CVE-2025-38499 CVE-2025-38500 CVE-2025-38503 CVE-2025-38505 CVE-2025-38506
CVE-2025-38507 CVE-2025-38508 CVE-2025-38510 CVE-2025-38511 CVE-2025-38512
CVE-2025-38513 CVE-2025-38514 CVE-2025-38515 CVE-2025-38516 CVE-2025-38520
CVE-2025-38521 CVE-2025-38524 CVE-2025-38526 CVE-2025-38527 CVE-2025-38528
CVE-2025-38529 CVE-2025-38530 CVE-2025-38531 CVE-2025-38533 CVE-2025-38535
CVE-2025-38537 CVE-2025-38538 CVE-2025-38539 CVE-2025-38539 CVE-2025-38540
CVE-2025-38541 CVE-2025-38543 CVE-2025-38544 CVE-2025-38545 CVE-2025-38546
CVE-2025-38547 CVE-2025-38548 CVE-2025-38549 CVE-2025-38550 CVE-2025-38551
CVE-2025-38552 CVE-2025-38553 CVE-2025-38554 CVE-2025-38555 CVE-2025-38556
CVE-2025-38557 CVE-2025-38559 CVE-2025-38560 CVE-2025-38563 CVE-2025-38564
CVE-2025-38565 CVE-2025-38566 CVE-2025-38568 CVE-2025-38569 CVE-2025-38571
CVE-2025-38572 CVE-2025-38573 CVE-2025-38574 CVE-2025-38576 CVE-2025-38581
CVE-2025-38582 CVE-2025-38583 CVE-2025-38584 CVE-2025-38585 CVE-2025-38586
CVE-2025-38587 CVE-2025-38588 CVE-2025-38589 CVE-2025-38590 CVE-2025-38591
CVE-2025-38593 CVE-2025-38595 CVE-2025-38597 CVE-2025-38601 CVE-2025-38602
CVE-2025-38604 CVE-2025-38605 CVE-2025-38608 CVE-2025-38609 CVE-2025-38610
CVE-2025-38612 CVE-2025-38614 CVE-2025-38616 CVE-2025-38617 CVE-2025-38618
CVE-2025-38619 CVE-2025-38621 CVE-2025-38622 CVE-2025-38623 CVE-2025-38624
CVE-2025-38625 CVE-2025-38628 CVE-2025-38630 CVE-2025-38631 CVE-2025-38632
CVE-2025-38634 CVE-2025-38635 CVE-2025-38639 CVE-2025-38640 CVE-2025-38643
CVE-2025-38644 CVE-2025-38645 CVE-2025-38646 CVE-2025-38648 CVE-2025-38653
CVE-2025-38656 CVE-2025-38658 CVE-2025-38659 CVE-2025-38660 CVE-2025-38662
CVE-2025-38664 CVE-2025-38665 CVE-2025-38668 CVE-2025-38670 CVE-2025-38671
CVE-2025-38676 CVE-2025-38678 CVE-2025-38679 CVE-2025-38680 CVE-2025-38681
CVE-2025-38683 CVE-2025-38684 CVE-2025-38685 CVE-2025-38686 CVE-2025-38687
CVE-2025-38691 CVE-2025-38692 CVE-2025-38693 CVE-2025-38694 CVE-2025-38695
CVE-2025-38700 CVE-2025-38701 CVE-2025-38702 CVE-2025-38703 CVE-2025-38704
CVE-2025-38705 CVE-2025-38706 CVE-2025-38709 CVE-2025-38710 CVE-2025-38717
CVE-2025-38718 CVE-2025-38721 CVE-2025-38722 CVE-2025-38724 CVE-2025-38725
CVE-2025-38727 CVE-2025-38728 CVE-2025-38729 CVE-2025-38730 CVE-2025-38732
CVE-2025-38733 CVE-2025-38734 CVE-2025-38735 CVE-2025-38736 CVE-2025-39673
CVE-2025-39675 CVE-2025-39676 CVE-2025-39677 CVE-2025-39678 CVE-2025-39679
CVE-2025-39681 CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685
CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691 CVE-2025-39693
CVE-2025-39694 CVE-2025-39695 CVE-2025-39697 CVE-2025-39698 CVE-2025-39700
CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39705 CVE-2025-39706
CVE-2025-39707 CVE-2025-39709 CVE-2025-39710 CVE-2025-39711 CVE-2025-39712
CVE-2025-39713 CVE-2025-39714 CVE-2025-39718 CVE-2025-39719 CVE-2025-39721
CVE-2025-39722 CVE-2025-39723 CVE-2025-39724 CVE-2025-39726 CVE-2025-39727
CVE-2025-39730 CVE-2025-39732 CVE-2025-39738 CVE-2025-39739 CVE-2025-39742
CVE-2025-39744 CVE-2025-39746 CVE-2025-39747 CVE-2025-39748 CVE-2025-39749
CVE-2025-39750 CVE-2025-39751 CVE-2025-39753 CVE-2025-39754 CVE-2025-39756
CVE-2025-39757 CVE-2025-39758 CVE-2025-39759 CVE-2025-39760 CVE-2025-39761
CVE-2025-39763 CVE-2025-39764 CVE-2025-39765 CVE-2025-39766 CVE-2025-39770
CVE-2025-39772 CVE-2025-39773 CVE-2025-39775 CVE-2025-39779 CVE-2025-39782
CVE-2025-39783 CVE-2025-39787 CVE-2025-39788 CVE-2025-39790 CVE-2025-39791
CVE-2025-39792 CVE-2025-39795 CVE-2025-39797 CVE-2025-39797 CVE-2025-39798
CVE-2025-39800 CVE-2025-39801 CVE-2025-39805 CVE-2025-39806 CVE-2025-39807
CVE-2025-39808 CVE-2025-39810 CVE-2025-39811 CVE-2025-39812 CVE-2025-39813
CVE-2025-39813 CVE-2025-39814 CVE-2025-39816 CVE-2025-39817 CVE-2025-39819
CVE-2025-39822 CVE-2025-39823 CVE-2025-39824 CVE-2025-39825 CVE-2025-39826
CVE-2025-39827 CVE-2025-39828 CVE-2025-39829 CVE-2025-39830 CVE-2025-39831
CVE-2025-39832 CVE-2025-39833 CVE-2025-39834 CVE-2025-39835 CVE-2025-39836
CVE-2025-39838 CVE-2025-39839 CVE-2025-39841 CVE-2025-39842 CVE-2025-39844
CVE-2025-39845 CVE-2025-39847 CVE-2025-39848 CVE-2025-39849 CVE-2025-39850
CVE-2025-39851 CVE-2025-39852 CVE-2025-39853 CVE-2025-39854 CVE-2025-39857
CVE-2025-39859 CVE-2025-39860 CVE-2025-39861 CVE-2025-39863 CVE-2025-39864
CVE-2025-39865 CVE-2025-39866 CVE-2025-39869 CVE-2025-39870 CVE-2025-39871
CVE-2025-39873 CVE-2025-39875 CVE-2025-39876 CVE-2025-39877 CVE-2025-39880
CVE-2025-39880 CVE-2025-39881 CVE-2025-39882 CVE-2025-39884 CVE-2025-39885
CVE-2025-39889 CVE-2025-39890 CVE-2025-39891 CVE-2025-39894 CVE-2025-39895
CVE-2025-39896 CVE-2025-39897 CVE-2025-39898 CVE-2025-39899 CVE-2025-39900
CVE-2025-39902 CVE-2025-39903 CVE-2025-39907 CVE-2025-39909 CVE-2025-39911
CVE-2025-39913 CVE-2025-39916 CVE-2025-39917 CVE-2025-39918 CVE-2025-39922
CVE-2025-39923 CVE-2025-39925 CVE-2025-39926 CVE-2025-39927 CVE-2025-39931
CVE-2025-39934 CVE-2025-39937 CVE-2025-39938 CVE-2025-39944 CVE-2025-39945
CVE-2025-39946 CVE-2025-39947 CVE-2025-39948 CVE-2025-39949 CVE-2025-39950
CVE-2025-39952 CVE-2025-39955 CVE-2025-39956 CVE-2025-39957 CVE-2025-39961
CVE-2025-39963 CVE-2025-39964 CVE-2025-39964 CVE-2025-39965 CVE-2025-39967
CVE-2025-39968 CVE-2025-39969 CVE-2025-39970 CVE-2025-39971 CVE-2025-39972
CVE-2025-39973 CVE-2025-39977 CVE-2025-39978 CVE-2025-39979 CVE-2025-39980
CVE-2025-39981 CVE-2025-39982 CVE-2025-39984 CVE-2025-39985 CVE-2025-39986
CVE-2025-39987 CVE-2025-39988 CVE-2025-39990 CVE-2025-39991 CVE-2025-39992
CVE-2025-39993 CVE-2025-39994 CVE-2025-39995 CVE-2025-39996 CVE-2025-39997
CVE-2025-39998 CVE-2025-40000 CVE-2025-40001 CVE-2025-40003 CVE-2025-40005
CVE-2025-40006 CVE-2025-40009 CVE-2025-40011 CVE-2025-40012 CVE-2025-40013
CVE-2025-40016 CVE-2025-40018 CVE-2025-40019 CVE-2025-40020 CVE-2025-40021
CVE-2025-40022 CVE-2025-40024 CVE-2025-40027 CVE-2025-40029 CVE-2025-40030
CVE-2025-40031 CVE-2025-40032 CVE-2025-40033 CVE-2025-40035 CVE-2025-40036
CVE-2025-40037 CVE-2025-40038 CVE-2025-40040 CVE-2025-40042 CVE-2025-40043
CVE-2025-40044 CVE-2025-40045 CVE-2025-40047 CVE-2025-40048 CVE-2025-40049
CVE-2025-40051 CVE-2025-40052 CVE-2025-40053 CVE-2025-40055 CVE-2025-40056
CVE-2025-40058 CVE-2025-40059 CVE-2025-40060 CVE-2025-40061 CVE-2025-40062
CVE-2025-40064 CVE-2025-40070 CVE-2025-40071 CVE-2025-40074 CVE-2025-40075
CVE-2025-40078 CVE-2025-40080 CVE-2025-40081 CVE-2025-40083 CVE-2025-40085
CVE-2025-40086 CVE-2025-40087 CVE-2025-40091 CVE-2025-40096 CVE-2025-40097
CVE-2025-40098 CVE-2025-40099 CVE-2025-40100 CVE-2025-40101 CVE-2025-40102
CVE-2025-40103 CVE-2025-40104 CVE-2025-40105 CVE-2025-40106 CVE-2025-40107
CVE-2025-40109 CVE-2025-40110 CVE-2025-40111 CVE-2025-40115 CVE-2025-40116
CVE-2025-40118 CVE-2025-40120 CVE-2025-40121 CVE-2025-40123 CVE-2025-40127
CVE-2025-40129 CVE-2025-40130 CVE-2025-40132 CVE-2025-40133 CVE-2025-40134
CVE-2025-40135 CVE-2025-40136 CVE-2025-40139 CVE-2025-40140 CVE-2025-40141
CVE-2025-40142 CVE-2025-40147 CVE-2025-40149 CVE-2025-40153 CVE-2025-40154
CVE-2025-40156 CVE-2025-40157 CVE-2025-40158 CVE-2025-40159 CVE-2025-40160
CVE-2025-40161 CVE-2025-40162 CVE-2025-40163 CVE-2025-40164 CVE-2025-40165
CVE-2025-40166 CVE-2025-40167 CVE-2025-40168 CVE-2025-40169 CVE-2025-40170
CVE-2025-40171 CVE-2025-40172 CVE-2025-40173 CVE-2025-40175 CVE-2025-40176
CVE-2025-40177 CVE-2025-40178 CVE-2025-40179 CVE-2025-40180 CVE-2025-40181
CVE-2025-40183 CVE-2025-40185 CVE-2025-40186 CVE-2025-40187 CVE-2025-40188
CVE-2025-40190 CVE-2025-40192 CVE-2025-40194 CVE-2025-40195 CVE-2025-40196
CVE-2025-40197 CVE-2025-40198 CVE-2025-40199 CVE-2025-40200 CVE-2025-40201
CVE-2025-40202 CVE-2025-40203 CVE-2025-40204 CVE-2025-40205 CVE-2025-40206
CVE-2025-40207 CVE-2025-40209 CVE-2025-40211 CVE-2025-40212 CVE-2025-40213
CVE-2025-40214 CVE-2025-40215 CVE-2025-40216 CVE-2025-40218 CVE-2025-40219
CVE-2025-40219 CVE-2025-40220 CVE-2025-40221 CVE-2025-40223 CVE-2025-40225
CVE-2025-40226 CVE-2025-40230 CVE-2025-40231 CVE-2025-40233 CVE-2025-40235
CVE-2025-40237 CVE-2025-40238 CVE-2025-40239 CVE-2025-40240 CVE-2025-40242
CVE-2025-40246 CVE-2025-40248 CVE-2025-40250 CVE-2025-40251 CVE-2025-40252
CVE-2025-40253 CVE-2025-40254 CVE-2025-40255 CVE-2025-40256 CVE-2025-40257
CVE-2025-40258 CVE-2025-40259 CVE-2025-40261 CVE-2025-40262 CVE-2025-40263
CVE-2025-40264 CVE-2025-40266 CVE-2025-40268 CVE-2025-40269 CVE-2025-40271
CVE-2025-40272 CVE-2025-40273 CVE-2025-40274 CVE-2025-40275 CVE-2025-40276
CVE-2025-40277 CVE-2025-40278 CVE-2025-40279 CVE-2025-40280 CVE-2025-40282
CVE-2025-40283 CVE-2025-40284 CVE-2025-40287 CVE-2025-40288 CVE-2025-40289
CVE-2025-40292 CVE-2025-40293 CVE-2025-40294 CVE-2025-40297 CVE-2025-40300
CVE-2025-40301 CVE-2025-40302 CVE-2025-40303 CVE-2025-40304 CVE-2025-40307
CVE-2025-40308 CVE-2025-40309 CVE-2025-40310 CVE-2025-40311 CVE-2025-40314
CVE-2025-40315 CVE-2025-40316 CVE-2025-40317 CVE-2025-40318 CVE-2025-40319
CVE-2025-40320 CVE-2025-40321 CVE-2025-40322 CVE-2025-40323 CVE-2025-40324
CVE-2025-40328 CVE-2025-40329 CVE-2025-40330 CVE-2025-40331 CVE-2025-40332
CVE-2025-40337 CVE-2025-40338 CVE-2025-40339 CVE-2025-40340 CVE-2025-40341
CVE-2025-40342 CVE-2025-40343 CVE-2025-40344 CVE-2025-40345 CVE-2025-40346
CVE-2025-40347 CVE-2025-40350 CVE-2025-40353 CVE-2025-40354 CVE-2025-40355
CVE-2025-40357 CVE-2025-40359 CVE-2025-40360 CVE-2025-40362 CVE-2025-40363
CVE-2025-40364 CVE-2025-54518 CVE-2025-54518 CVE-2025-54770 CVE-2025-54771
CVE-2025-58050 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018 CVE-2025-66199
CVE-2025-66293 CVE-2025-68160 CVE-2025-68167 CVE-2025-68170 CVE-2025-68171
CVE-2025-68172 CVE-2025-68173 CVE-2025-68174 CVE-2025-68176 CVE-2025-68178
CVE-2025-68179 CVE-2025-68180 CVE-2025-68181 CVE-2025-68183 CVE-2025-68184
CVE-2025-68185 CVE-2025-68186 CVE-2025-68188 CVE-2025-68190 CVE-2025-68192
CVE-2025-68194 CVE-2025-68195 CVE-2025-68197 CVE-2025-68198 CVE-2025-68200
CVE-2025-68201 CVE-2025-68202 CVE-2025-68204 CVE-2025-68206 CVE-2025-68207
CVE-2025-68208 CVE-2025-68209 CVE-2025-68210 CVE-2025-68211 CVE-2025-68213
CVE-2025-68214 CVE-2025-68215 CVE-2025-68217 CVE-2025-68218 CVE-2025-68222
CVE-2025-68223 CVE-2025-68227 CVE-2025-68230 CVE-2025-68233 CVE-2025-68235
CVE-2025-68237 CVE-2025-68238 CVE-2025-68239 CVE-2025-68241 CVE-2025-68242
CVE-2025-68244 CVE-2025-68245 CVE-2025-68249 CVE-2025-68252 CVE-2025-68254
CVE-2025-68255 CVE-2025-68256 CVE-2025-68257 CVE-2025-68258 CVE-2025-68259
CVE-2025-68261 CVE-2025-68264 CVE-2025-68265 CVE-2025-68283 CVE-2025-68284
CVE-2025-68285 CVE-2025-68286 CVE-2025-68287 CVE-2025-68289 CVE-2025-68290
CVE-2025-68292 CVE-2025-68293 CVE-2025-68295 CVE-2025-68296 CVE-2025-68297
CVE-2025-68298 CVE-2025-68301 CVE-2025-68302 CVE-2025-68303 CVE-2025-68305
CVE-2025-68306 CVE-2025-68307 CVE-2025-68308 CVE-2025-68310 CVE-2025-68311
CVE-2025-68312 CVE-2025-68313 CVE-2025-68317 CVE-2025-68320 CVE-2025-68325
CVE-2025-68327 CVE-2025-68328 CVE-2025-68329 CVE-2025-68330 CVE-2025-68331
CVE-2025-68332 CVE-2025-68335 CVE-2025-68337 CVE-2025-68339 CVE-2025-68340
CVE-2025-68341 CVE-2025-68342 CVE-2025-68343 CVE-2025-68344 CVE-2025-68345
CVE-2025-68346 CVE-2025-68347 CVE-2025-68348 CVE-2025-68349 CVE-2025-68351
CVE-2025-68352 CVE-2025-68353 CVE-2025-68354 CVE-2025-68356 CVE-2025-68358
CVE-2025-68359 CVE-2025-68360 CVE-2025-68361 CVE-2025-68362 CVE-2025-68363
CVE-2025-68366 CVE-2025-68367 CVE-2025-68368 CVE-2025-68371 CVE-2025-68372
CVE-2025-68374 CVE-2025-68376 CVE-2025-68378 CVE-2025-68379 CVE-2025-68380
CVE-2025-68724 CVE-2025-68725 CVE-2025-68732 CVE-2025-68735 CVE-2025-68736
CVE-2025-68740 CVE-2025-68741 CVE-2025-68742 CVE-2025-68743 CVE-2025-68744
CVE-2025-68745 CVE-2025-68746 CVE-2025-68747 CVE-2025-68748 CVE-2025-68749
CVE-2025-68750 CVE-2025-68753 CVE-2025-68757 CVE-2025-68758 CVE-2025-68759
CVE-2025-68764 CVE-2025-68765 CVE-2025-68766 CVE-2025-68768 CVE-2025-68770
CVE-2025-68771 CVE-2025-68773 CVE-2025-68775 CVE-2025-68776 CVE-2025-68777
CVE-2025-68778 CVE-2025-68780 CVE-2025-68783 CVE-2025-68784 CVE-2025-68785
CVE-2025-68788 CVE-2025-68789 CVE-2025-68792 CVE-2025-68794 CVE-2025-68795
CVE-2025-68797 CVE-2025-68798 CVE-2025-68799 CVE-2025-68800 CVE-2025-68801
CVE-2025-68802 CVE-2025-68803 CVE-2025-68804 CVE-2025-68808 CVE-2025-68810
CVE-2025-68811 CVE-2025-68813 CVE-2025-68814 CVE-2025-68815 CVE-2025-68816
CVE-2025-68818 CVE-2025-68819 CVE-2025-68820 CVE-2025-68821 CVE-2025-68822
CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2025-69720
CVE-2025-71064 CVE-2025-71066 CVE-2025-71071 CVE-2025-71073 CVE-2025-71075
CVE-2025-71076 CVE-2025-71077 CVE-2025-71078 CVE-2025-71079 CVE-2025-71080
CVE-2025-71081 CVE-2025-71082 CVE-2025-71083 CVE-2025-71084 CVE-2025-71085
CVE-2025-71086 CVE-2025-71087 CVE-2025-71088 CVE-2025-71089 CVE-2025-71091
CVE-2025-71093 CVE-2025-71094 CVE-2025-71095 CVE-2025-71096 CVE-2025-71097
CVE-2025-71098 CVE-2025-71099 CVE-2025-71100 CVE-2025-71101 CVE-2025-71104
CVE-2025-71108 CVE-2025-71111 CVE-2025-71112 CVE-2025-71113 CVE-2025-71114
CVE-2025-71116 CVE-2025-71118 CVE-2025-71119 CVE-2025-71120 CVE-2025-71123
CVE-2025-71125 CVE-2025-71126 CVE-2025-71130 CVE-2025-71131 CVE-2025-71132
CVE-2025-71133 CVE-2025-71134 CVE-2025-71135 CVE-2025-71136 CVE-2025-71137
CVE-2025-71138 CVE-2025-71141 CVE-2025-71142 CVE-2025-71143 CVE-2025-71145
CVE-2025-71147 CVE-2025-71148 CVE-2025-71149 CVE-2025-71154 CVE-2025-71156
CVE-2025-71157 CVE-2025-71161 CVE-2025-71162 CVE-2025-71163 CVE-2025-71182
CVE-2025-71183 CVE-2025-71184 CVE-2025-71185 CVE-2025-71186 CVE-2025-71188
CVE-2025-71189 CVE-2025-71190 CVE-2025-71191 CVE-2025-71192 CVE-2025-71193
CVE-2025-71194 CVE-2025-71195 CVE-2025-71196 CVE-2025-71197 CVE-2025-71198
CVE-2025-71199 CVE-2025-71200 CVE-2025-71222 CVE-2025-71224 CVE-2025-71225
CVE-2025-71229 CVE-2025-71231 CVE-2025-71232 CVE-2025-71233 CVE-2025-71234
CVE-2025-71235 CVE-2025-71236 CVE-2025-71238 CVE-2025-71239 CVE-2025-71268
CVE-2025-71269 CVE-2025-71273 CVE-2025-71274 CVE-2025-71286 CVE-2025-71287
CVE-2025-71288 CVE-2025-71291 CVE-2025-71294 CVE-2025-71297 CVE-2025-71302
CVE-2025-71305 CVE-2025-71314 CVE-2025-8732 CVE-2025-9230 CVE-2025-9231
CVE-2025-9232 CVE-2026-0861 CVE-2026-0915 CVE-2026-0989 CVE-2026-0990
CVE-2026-0992 CVE-2026-100075 CVE-2026-11979 CVE-2026-12087 CVE-2026-13221
CVE-2026-13595 CVE-2026-14456 CVE-2026-14457 CVE-2026-16742 CVE-2026-1757
CVE-2026-18374 CVE-2026-18798 CVE-2026-19499 CVE-2026-19542 CVE-2026-22695
CVE-2026-22795 CVE-2026-22796 CVE-2026-22801 CVE-2026-22976 CVE-2026-22977
CVE-2026-22978 CVE-2026-22979 CVE-2026-22980 CVE-2026-22981 CVE-2026-22982
CVE-2026-22984 CVE-2026-22985 CVE-2026-22986 CVE-2026-22988 CVE-2026-22989
CVE-2026-22990 CVE-2026-22991 CVE-2026-22992 CVE-2026-22993 CVE-2026-22996
CVE-2026-22997 CVE-2026-22998 CVE-2026-22999 CVE-2026-23000 CVE-2026-23001
CVE-2026-23002 CVE-2026-23003 CVE-2026-23004 CVE-2026-23005 CVE-2026-23006
CVE-2026-23010 CVE-2026-23011 CVE-2026-23017 CVE-2026-23018 CVE-2026-23021
CVE-2026-23022 CVE-2026-23023 CVE-2026-23024 CVE-2026-23026 CVE-2026-23030
CVE-2026-23031 CVE-2026-23033 CVE-2026-23035 CVE-2026-23036 CVE-2026-23037
CVE-2026-23038 CVE-2026-23042 CVE-2026-23047 CVE-2026-23049 CVE-2026-23050
CVE-2026-23052 CVE-2026-23053 CVE-2026-23054 CVE-2026-23055 CVE-2026-23056
CVE-2026-23057 CVE-2026-23058 CVE-2026-23059 CVE-2026-23060 CVE-2026-23061
CVE-2026-23062 CVE-2026-23063 CVE-2026-23064 CVE-2026-23065 CVE-2026-23066
CVE-2026-23068 CVE-2026-23069 CVE-2026-23070 CVE-2026-23071 CVE-2026-23072
CVE-2026-23073 CVE-2026-23074 CVE-2026-23076 CVE-2026-23078 CVE-2026-23080
CVE-2026-23082 CVE-2026-23083 CVE-2026-23084 CVE-2026-23085 CVE-2026-23086
CVE-2026-23088 CVE-2026-23089 CVE-2026-23090 CVE-2026-23091 CVE-2026-23094
CVE-2026-23095 CVE-2026-23096 CVE-2026-23097 CVE-2026-23099 CVE-2026-23100
CVE-2026-23101 CVE-2026-23102 CVE-2026-23103 CVE-2026-23104 CVE-2026-23105
CVE-2026-23107 CVE-2026-23108 CVE-2026-23110 CVE-2026-23111 CVE-2026-23112
CVE-2026-23113 CVE-2026-23116 CVE-2026-23119 CVE-2026-23120 CVE-2026-23121
CVE-2026-23123 CVE-2026-23125 CVE-2026-23128 CVE-2026-23129 CVE-2026-23131
CVE-2026-23133 CVE-2026-23135 CVE-2026-23136 CVE-2026-23137 CVE-2026-23138
CVE-2026-23139 CVE-2026-23140 CVE-2026-23141 CVE-2026-23142 CVE-2026-23144
CVE-2026-23145 CVE-2026-23146 CVE-2026-23148 CVE-2026-23150 CVE-2026-23151
CVE-2026-23152 CVE-2026-23154 CVE-2026-23155 CVE-2026-23156 CVE-2026-23157
CVE-2026-23158 CVE-2026-23161 CVE-2026-23163 CVE-2026-23166 CVE-2026-23167
CVE-2026-23168 CVE-2026-23169 CVE-2026-23170 CVE-2026-23171 CVE-2026-23172
CVE-2026-23173 CVE-2026-23176 CVE-2026-23177 CVE-2026-23178 CVE-2026-23179
CVE-2026-23182 CVE-2026-23187 CVE-2026-23188 CVE-2026-23189 CVE-2026-23190
CVE-2026-23191 CVE-2026-23193 CVE-2026-23198 CVE-2026-23199 CVE-2026-23201
CVE-2026-23202 CVE-2026-23204 CVE-2026-23207 CVE-2026-23208 CVE-2026-23209
CVE-2026-23209 CVE-2026-23210 CVE-2026-23213 CVE-2026-23214 CVE-2026-23215
CVE-2026-23216 CVE-2026-23221 CVE-2026-23222 CVE-2026-23223 CVE-2026-23224
CVE-2026-23227 CVE-2026-23229 CVE-2026-23230 CVE-2026-23231 CVE-2026-23236
CVE-2026-23237 CVE-2026-23239 CVE-2026-23240 CVE-2026-23242 CVE-2026-23243
CVE-2026-23245 CVE-2026-23246 CVE-2026-23248 CVE-2026-23253 CVE-2026-23254
CVE-2026-23255 CVE-2026-23259 CVE-2026-23260 CVE-2026-23261 CVE-2026-23262
CVE-2026-23264 CVE-2026-23266 CVE-2026-23268 CVE-2026-23269 CVE-2026-23270
CVE-2026-23271 CVE-2026-23272 CVE-2026-23273 CVE-2026-23274 CVE-2026-23276
CVE-2026-23276 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279 CVE-2026-23281
CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293 CVE-2026-23297
CVE-2026-23298 CVE-2026-23300 CVE-2026-23303 CVE-2026-23304 CVE-2026-23306
CVE-2026-23307 CVE-2026-23308 CVE-2026-23312 CVE-2026-23313 CVE-2026-23315
CVE-2026-23316 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319 CVE-2026-23321
CVE-2026-23324 CVE-2026-23325 CVE-2026-23326 CVE-2026-23327 CVE-2026-23334
CVE-2026-23335 CVE-2026-23336 CVE-2026-23339 CVE-2026-23340 CVE-2026-23343
CVE-2026-23346 CVE-2026-23347 CVE-2026-23348 CVE-2026-23351 CVE-2026-23352
CVE-2026-23354 CVE-2026-23357 CVE-2026-23359 CVE-2026-23360 CVE-2026-23361
CVE-2026-23362 CVE-2026-23363 CVE-2026-23365 CVE-2026-23367 CVE-2026-23368
CVE-2026-23369 CVE-2026-23370 CVE-2026-23372 CVE-2026-23373 CVE-2026-23374
CVE-2026-23375 CVE-2026-23378 CVE-2026-23379 CVE-2026-23380 CVE-2026-23381
CVE-2026-23382 CVE-2026-23383 CVE-2026-23386 CVE-2026-23387 CVE-2026-23391
CVE-2026-23392 CVE-2026-23393 CVE-2026-23394 CVE-2026-23395 CVE-2026-23396
CVE-2026-23397 CVE-2026-23398 CVE-2026-23399 CVE-2026-23401 CVE-2026-23403
CVE-2026-23404 CVE-2026-23405 CVE-2026-23406 CVE-2026-23407 CVE-2026-23408
CVE-2026-23409 CVE-2026-23410 CVE-2026-23411 CVE-2026-23413 CVE-2026-23414
CVE-2026-23417 CVE-2026-23418 CVE-2026-23419 CVE-2026-23420 CVE-2026-23425
CVE-2026-23426 CVE-2026-23434 CVE-2026-23436 CVE-2026-23437 CVE-2026-23438
CVE-2026-23440 CVE-2026-23441 CVE-2026-23442 CVE-2026-23443 CVE-2026-23444
CVE-2026-23445 CVE-2026-23446 CVE-2026-23447 CVE-2026-23448 CVE-2026-23449
CVE-2026-23450 CVE-2026-23451 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455
CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23460 CVE-2026-23461
CVE-2026-23462 CVE-2026-23463 CVE-2026-23464 CVE-2026-23465 CVE-2026-23466
CVE-2026-23468 CVE-2026-23470 CVE-2026-23472 CVE-2026-23473 CVE-2026-23474
CVE-2026-23475 CVE-2026-23865 CVE-2026-25646 CVE-2026-2673 CVE-2026-2673
CVE-2026-27171 CVE-2026-27456 CVE-2026-27456 CVE-2026-28387 CVE-2026-28388
CVE-2026-28389 CVE-2026-28390 CVE-2026-29111 CVE-2026-29111 CVE-2026-31389
CVE-2026-31392 CVE-2026-31393 CVE-2026-31394 CVE-2026-31395 CVE-2026-31396
CVE-2026-31400 CVE-2026-31401 CVE-2026-31402 CVE-2026-31403 CVE-2026-31405
CVE-2026-31406 CVE-2026-31407 CVE-2026-31408 CVE-2026-31411 CVE-2026-31412
CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418
CVE-2026-31420 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424
CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428 CVE-2026-31429
CVE-2026-31430 CVE-2026-31431 CVE-2026-31431 CVE-2026-31435 CVE-2026-31436
CVE-2026-31438 CVE-2026-31439 CVE-2026-31440 CVE-2026-31441 CVE-2026-31442
CVE-2026-31443 CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449
CVE-2026-31450 CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455
CVE-2026-31456 CVE-2026-31462 CVE-2026-31464 CVE-2026-31466 CVE-2026-31467
CVE-2026-31469 CVE-2026-31470 CVE-2026-31473 CVE-2026-31474 CVE-2026-31479
CVE-2026-31480 CVE-2026-31482 CVE-2026-31483 CVE-2026-31483 CVE-2026-31485
CVE-2026-31488 CVE-2026-31489 CVE-2026-31492 CVE-2026-31493 CVE-2026-31494
CVE-2026-31495 CVE-2026-31496 CVE-2026-31497 CVE-2026-31498 CVE-2026-31499
CVE-2026-31500 CVE-2026-31502 CVE-2026-31503 CVE-2026-31504 CVE-2026-31505
CVE-2026-31507 CVE-2026-31509 CVE-2026-31510 CVE-2026-31511 CVE-2026-31512
CVE-2026-31513 CVE-2026-31514 CVE-2026-31515 CVE-2026-31516 CVE-2026-31518
CVE-2026-31519 CVE-2026-31520 CVE-2026-31521 CVE-2026-31522 CVE-2026-31523
CVE-2026-31524 CVE-2026-31525 CVE-2026-31526 CVE-2026-31528 CVE-2026-31530
CVE-2026-31531 CVE-2026-31532 CVE-2026-31533 CVE-2026-31540 CVE-2026-31542
CVE-2026-31545 CVE-2026-31546 CVE-2026-31547 CVE-2026-31548 CVE-2026-31549
CVE-2026-31550 CVE-2026-31551 CVE-2026-31552 CVE-2026-31554 CVE-2026-31555
CVE-2026-31556 CVE-2026-31557 CVE-2026-31560 CVE-2026-31561 CVE-2026-31562
CVE-2026-31565 CVE-2026-31566 CVE-2026-31568 CVE-2026-31570 CVE-2026-31575
CVE-2026-31576 CVE-2026-31578 CVE-2026-31579 CVE-2026-31580 CVE-2026-31580
CVE-2026-31581 CVE-2026-31582 CVE-2026-31583 CVE-2026-31584 CVE-2026-31585
CVE-2026-31586 CVE-2026-31587 CVE-2026-31588 CVE-2026-31590 CVE-2026-31591
CVE-2026-31592 CVE-2026-31593 CVE-2026-31595 CVE-2026-31596 CVE-2026-31598
CVE-2026-31599 CVE-2026-31602 CVE-2026-31603 CVE-2026-31604 CVE-2026-31605
CVE-2026-31606 CVE-2026-31607 CVE-2026-31613 CVE-2026-31614 CVE-2026-31615
CVE-2026-31616 CVE-2026-31617 CVE-2026-31618 CVE-2026-31619 CVE-2026-31622
CVE-2026-31623 CVE-2026-31624 CVE-2026-31625 CVE-2026-31626 CVE-2026-31627
CVE-2026-31628 CVE-2026-31629 CVE-2026-31644 CVE-2026-31645 CVE-2026-31646
CVE-2026-31647 CVE-2026-31648 CVE-2026-31649 CVE-2026-31651 CVE-2026-31655
CVE-2026-31656 CVE-2026-31657 CVE-2026-31658 CVE-2026-31659 CVE-2026-31660
CVE-2026-31661 CVE-2026-31662 CVE-2026-31663 CVE-2026-31664 CVE-2026-31665
CVE-2026-31666 CVE-2026-31667 CVE-2026-31668 CVE-2026-31669 CVE-2026-31670
CVE-2026-31671 CVE-2026-31672 CVE-2026-31673 CVE-2026-31674 CVE-2026-31675
CVE-2026-31677 CVE-2026-31678 CVE-2026-31679 CVE-2026-31680 CVE-2026-31681
CVE-2026-31682 CVE-2026-31683 CVE-2026-31684 CVE-2026-31685 CVE-2026-31687
CVE-2026-31691 CVE-2026-31693 CVE-2026-31694 CVE-2026-31697 CVE-2026-31698
CVE-2026-31699 CVE-2026-31700 CVE-2026-31701 CVE-2026-31703 CVE-2026-31720
CVE-2026-31721 CVE-2026-31726 CVE-2026-31727 CVE-2026-31728 CVE-2026-31729
CVE-2026-31730 CVE-2026-31736 CVE-2026-31738 CVE-2026-31739 CVE-2026-31740
CVE-2026-31741 CVE-2026-31743 CVE-2026-31747 CVE-2026-31748 CVE-2026-31749
CVE-2026-31751 CVE-2026-31752 CVE-2026-31754 CVE-2026-31755 CVE-2026-31756
CVE-2026-31758 CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763
CVE-2026-31765 CVE-2026-31767 CVE-2026-31768 CVE-2026-31770 CVE-2026-31771
CVE-2026-31772 CVE-2026-31773 CVE-2026-31774 CVE-2026-31776 CVE-2026-31778
CVE-2026-31779 CVE-2026-31780 CVE-2026-31781 CVE-2026-31787 CVE-2026-31788
CVE-2026-31789 CVE-2026-31790 CVE-2026-3184 CVE-2026-33416 CVE-2026-33636
CVE-2026-34180 CVE-2026-34181 CVE-2026-34182 CVE-2026-34183 CVE-2026-34743
CVE-2026-34757 CVE-2026-35189 CVE-2026-35191 CVE-2026-40226 CVE-2026-4046
CVE-2026-40467 CVE-2026-40468 CVE-2026-40553 CVE-2026-4105 CVE-2026-4105
CVE-2026-41989 CVE-2026-41990 CVE-2026-41991 CVE-2026-41992 CVE-2026-42250
CVE-2026-42764 CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769
CVE-2026-42770 CVE-2026-43007 CVE-2026-43009 CVE-2026-43009 CVE-2026-43010
CVE-2026-43011 CVE-2026-43012 CVE-2026-43013 CVE-2026-43014 CVE-2026-43015
CVE-2026-43016 CVE-2026-43017 CVE-2026-43018 CVE-2026-43019 CVE-2026-43020
CVE-2026-43022 CVE-2026-43023 CVE-2026-43024 CVE-2026-43025 CVE-2026-43026
CVE-2026-43027 CVE-2026-43028 CVE-2026-43030 CVE-2026-43032 CVE-2026-43033
CVE-2026-43034 CVE-2026-43035 CVE-2026-43036 CVE-2026-43037 CVE-2026-43038
CVE-2026-43040 CVE-2026-43043 CVE-2026-43044 CVE-2026-43045 CVE-2026-43046
CVE-2026-43047 CVE-2026-43049 CVE-2026-43050 CVE-2026-43051 CVE-2026-43052
CVE-2026-43053 CVE-2026-43054 CVE-2026-43056 CVE-2026-43057 CVE-2026-43058
CVE-2026-43059 CVE-2026-43060 CVE-2026-43061 CVE-2026-43062 CVE-2026-43063
CVE-2026-43064 CVE-2026-43065 CVE-2026-43066 CVE-2026-43068 CVE-2026-43069
CVE-2026-43072 CVE-2026-43074 CVE-2026-43077 CVE-2026-43079 CVE-2026-43080
CVE-2026-43081 CVE-2026-43082 CVE-2026-43083 CVE-2026-43085 CVE-2026-43086
CVE-2026-43088 CVE-2026-43089 CVE-2026-43090 CVE-2026-43091 CVE-2026-43092
CVE-2026-43093 CVE-2026-43094 CVE-2026-43098 CVE-2026-43101 CVE-2026-43104
CVE-2026-43105 CVE-2026-43107 CVE-2026-43108 CVE-2026-43109 CVE-2026-43110
CVE-2026-43111 CVE-2026-43112 CVE-2026-43113 CVE-2026-43114 CVE-2026-43116
CVE-2026-43117 CVE-2026-43118 CVE-2026-43119 CVE-2026-43120 CVE-2026-43123
CVE-2026-43124 CVE-2026-43125 CVE-2026-43126 CVE-2026-43128 CVE-2026-43129
CVE-2026-43130 CVE-2026-43132 CVE-2026-43133 CVE-2026-43134 CVE-2026-43135
CVE-2026-43136 CVE-2026-43137 CVE-2026-43138 CVE-2026-43139 CVE-2026-43140
CVE-2026-43141 CVE-2026-43143 CVE-2026-43145 CVE-2026-43147 CVE-2026-43150
CVE-2026-43152 CVE-2026-43153 CVE-2026-43156 CVE-2026-43157 CVE-2026-43158
CVE-2026-43159 CVE-2026-43161 CVE-2026-43162 CVE-2026-43163 CVE-2026-43167
CVE-2026-43168 CVE-2026-43169 CVE-2026-43170 CVE-2026-43171 CVE-2026-43172
CVE-2026-43175 CVE-2026-43177 CVE-2026-43180 CVE-2026-43182 CVE-2026-43183
CVE-2026-43184 CVE-2026-43187 CVE-2026-43189 CVE-2026-43190 CVE-2026-43191
CVE-2026-43194 CVE-2026-43196 CVE-2026-43197 CVE-2026-43198 CVE-2026-43199
CVE-2026-43200 CVE-2026-43202 CVE-2026-43203 CVE-2026-43204 CVE-2026-43205
CVE-2026-43206 CVE-2026-43207 CVE-2026-43210 CVE-2026-43211 CVE-2026-43213
CVE-2026-43214 CVE-2026-43216 CVE-2026-43218 CVE-2026-43220 CVE-2026-43221
CVE-2026-43222 CVE-2026-43223 CVE-2026-43225 CVE-2026-43226 CVE-2026-43229
CVE-2026-43230 CVE-2026-43231 CVE-2026-43232 CVE-2026-43233 CVE-2026-43234
CVE-2026-43236 CVE-2026-43238 CVE-2026-43239 CVE-2026-43240 CVE-2026-43240
CVE-2026-43241 CVE-2026-43242 CVE-2026-43243 CVE-2026-43244 CVE-2026-43246
CVE-2026-43248 CVE-2026-43249 CVE-2026-43250 CVE-2026-43251 CVE-2026-43252
CVE-2026-43253 CVE-2026-43255 CVE-2026-43256 CVE-2026-43257 CVE-2026-43260
CVE-2026-43261 CVE-2026-43262 CVE-2026-43264 CVE-2026-43265 CVE-2026-43266
CVE-2026-43269 CVE-2026-43270 CVE-2026-43271 CVE-2026-43272 CVE-2026-43273
CVE-2026-43275 CVE-2026-43276 CVE-2026-43277 CVE-2026-43278 CVE-2026-43279
CVE-2026-43281 CVE-2026-43283 CVE-2026-43284 CVE-2026-43284 CVE-2026-43287
CVE-2026-43291 CVE-2026-43293 CVE-2026-43295 CVE-2026-43296 CVE-2026-43297
CVE-2026-43298 CVE-2026-43299 CVE-2026-43300 CVE-2026-43302 CVE-2026-43303
CVE-2026-43304 CVE-2026-43306 CVE-2026-43307 CVE-2026-43308 CVE-2026-43309
CVE-2026-43312 CVE-2026-43313 CVE-2026-43314 CVE-2026-43316 CVE-2026-43318
CVE-2026-43319 CVE-2026-43320 CVE-2026-43324 CVE-2026-43325 CVE-2026-43327
CVE-2026-43328 CVE-2026-43329 CVE-2026-43330 CVE-2026-43331 CVE-2026-43332
CVE-2026-43333 CVE-2026-43334 CVE-2026-43336 CVE-2026-43337 CVE-2026-43338
CVE-2026-43339 CVE-2026-43340 CVE-2026-43341 CVE-2026-43342 CVE-2026-43343
CVE-2026-43344 CVE-2026-43345 CVE-2026-43346 CVE-2026-43351 CVE-2026-43352
CVE-2026-43353 CVE-2026-43354 CVE-2026-43355 CVE-2026-43357 CVE-2026-43359
CVE-2026-43360 CVE-2026-43361 CVE-2026-43362 CVE-2026-43363 CVE-2026-43365
CVE-2026-43366 CVE-2026-43368 CVE-2026-43370 CVE-2026-43373 CVE-2026-43374
CVE-2026-43380 CVE-2026-43381 CVE-2026-43382 CVE-2026-43383 CVE-2026-43384
CVE-2026-43386 CVE-2026-43387 CVE-2026-43393 CVE-2026-43394 CVE-2026-43395
CVE-2026-43397 CVE-2026-43403 CVE-2026-43405 CVE-2026-43406 CVE-2026-43407
CVE-2026-43409 CVE-2026-43411 CVE-2026-43412 CVE-2026-43413 CVE-2026-43414
CVE-2026-43415 CVE-2026-43416 CVE-2026-43424 CVE-2026-43425 CVE-2026-43426
CVE-2026-43427 CVE-2026-43428 CVE-2026-43429 CVE-2026-43430 CVE-2026-43432
CVE-2026-43436 CVE-2026-43437 CVE-2026-43439 CVE-2026-43440 CVE-2026-43441
CVE-2026-43443 CVE-2026-43444 CVE-2026-43445 CVE-2026-43448 CVE-2026-43449
CVE-2026-43450 CVE-2026-43451 CVE-2026-43452 CVE-2026-43455 CVE-2026-43456
CVE-2026-43457 CVE-2026-43458 CVE-2026-43459 CVE-2026-43465 CVE-2026-43466
CVE-2026-43467 CVE-2026-43468 CVE-2026-43469 CVE-2026-43470 CVE-2026-43471
CVE-2026-43472 CVE-2026-43473 CVE-2026-43475 CVE-2026-43476 CVE-2026-43480
CVE-2026-43481 CVE-2026-43483 CVE-2026-43486 CVE-2026-43487 CVE-2026-43488
CVE-2026-43491 CVE-2026-43492 CVE-2026-43493 CVE-2026-43494 CVE-2026-43495
CVE-2026-43496 CVE-2026-43499 CVE-2026-43500 CVE-2026-43501 CVE-2026-43502
CVE-2026-43503 CVE-2026-4437 CVE-2026-4438 CVE-2026-44604 CVE-2026-44605
CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 CVE-2026-45834 CVE-2026-45835
CVE-2026-45836 CVE-2026-45837 CVE-2026-45838 CVE-2026-45839 CVE-2026-45840
CVE-2026-45841 CVE-2026-45842 CVE-2026-45843 CVE-2026-45845 CVE-2026-45846
CVE-2026-45848 CVE-2026-45849 CVE-2026-45851 CVE-2026-45852 CVE-2026-45853
CVE-2026-45856 CVE-2026-45857 CVE-2026-45858 CVE-2026-45859 CVE-2026-45860
CVE-2026-45861 CVE-2026-45862 CVE-2026-45863 CVE-2026-45865 CVE-2026-45866
CVE-2026-45867 CVE-2026-45868 CVE-2026-45869 CVE-2026-45870 CVE-2026-45871
CVE-2026-45872 CVE-2026-45873 CVE-2026-45874 CVE-2026-45875 CVE-2026-45877
CVE-2026-45878 CVE-2026-45879 CVE-2026-45880 CVE-2026-45881 CVE-2026-45882
CVE-2026-45883 CVE-2026-45884 CVE-2026-45885 CVE-2026-45886 CVE-2026-45888
CVE-2026-45891 CVE-2026-45894 CVE-2026-45895 CVE-2026-45897 CVE-2026-45898
CVE-2026-45899 CVE-2026-45900 CVE-2026-45901 CVE-2026-45902 CVE-2026-45904
CVE-2026-45905 CVE-2026-45910 CVE-2026-45911 CVE-2026-45912 CVE-2026-45913
CVE-2026-45915 CVE-2026-45916 CVE-2026-45917 CVE-2026-45920 CVE-2026-45921
CVE-2026-45922 CVE-2026-45923 CVE-2026-45925 CVE-2026-45928 CVE-2026-45930
CVE-2026-45932 CVE-2026-45933 CVE-2026-45936 CVE-2026-45938 CVE-2026-45940
CVE-2026-45941 CVE-2026-45942 CVE-2026-45944 CVE-2026-45946 CVE-2026-45947
CVE-2026-45948 CVE-2026-45950 CVE-2026-45954 CVE-2026-45958 CVE-2026-45961
CVE-2026-45963 CVE-2026-45964 CVE-2026-45965 CVE-2026-45968 CVE-2026-45969
CVE-2026-45970 CVE-2026-45973 CVE-2026-45974 CVE-2026-45976 CVE-2026-45981
CVE-2026-45982 CVE-2026-45983 CVE-2026-45984 CVE-2026-45985 CVE-2026-45986
CVE-2026-45987 CVE-2026-45994 CVE-2026-45996 CVE-2026-45997 CVE-2026-45999
CVE-2026-46001 CVE-2026-46003 CVE-2026-46004 CVE-2026-46005 CVE-2026-46006
CVE-2026-46007 CVE-2026-46009 CVE-2026-46011 CVE-2026-46015 CVE-2026-46016
CVE-2026-46018 CVE-2026-46019 CVE-2026-46021 CVE-2026-46023 CVE-2026-46024
CVE-2026-46026 CVE-2026-46027 CVE-2026-46033 CVE-2026-46034 CVE-2026-46036
CVE-2026-46037 CVE-2026-46038 CVE-2026-46040 CVE-2026-46043 CVE-2026-46044
CVE-2026-46046 CVE-2026-46048 CVE-2026-46049 CVE-2026-46050 CVE-2026-46051
CVE-2026-46053 CVE-2026-46056 CVE-2026-46058 CVE-2026-46059 CVE-2026-46060
CVE-2026-46063 CVE-2026-46064 CVE-2026-46065 CVE-2026-46068 CVE-2026-46069
CVE-2026-46070 CVE-2026-46071 CVE-2026-46073 CVE-2026-46074 CVE-2026-46075
CVE-2026-46076 CVE-2026-46077 CVE-2026-46078 CVE-2026-46079 CVE-2026-46080
CVE-2026-46082 CVE-2026-46083 CVE-2026-46084 CVE-2026-46086 CVE-2026-46088
CVE-2026-46089 CVE-2026-46090 CVE-2026-46091 CVE-2026-46091 CVE-2026-46092
CVE-2026-46093 CVE-2026-46094 CVE-2026-46096 CVE-2026-46099 CVE-2026-46101
CVE-2026-46102 CVE-2026-46103 CVE-2026-46107 CVE-2026-46108 CVE-2026-46109
CVE-2026-46110 CVE-2026-46111 CVE-2026-46112 CVE-2026-46113 CVE-2026-46114
CVE-2026-46115 CVE-2026-46116 CVE-2026-46117 CVE-2026-46119 CVE-2026-46120
CVE-2026-46121 CVE-2026-46122 CVE-2026-46123 CVE-2026-46124 CVE-2026-46125
CVE-2026-46126 CVE-2026-46127 CVE-2026-46128 CVE-2026-46130 CVE-2026-46131
CVE-2026-46132 CVE-2026-46133 CVE-2026-46135 CVE-2026-46136 CVE-2026-46137
CVE-2026-46138 CVE-2026-46140 CVE-2026-46143 CVE-2026-46144 CVE-2026-46145
CVE-2026-46146 CVE-2026-46147 CVE-2026-46149 CVE-2026-46150 CVE-2026-46151
CVE-2026-46152 CVE-2026-46157 CVE-2026-46158 CVE-2026-46159 CVE-2026-46160
CVE-2026-46161 CVE-2026-46162 CVE-2026-46163 CVE-2026-46165 CVE-2026-46166
CVE-2026-46167 CVE-2026-46168 CVE-2026-46170 CVE-2026-46172 CVE-2026-46173
CVE-2026-46174 CVE-2026-46176 CVE-2026-46177 CVE-2026-46178 CVE-2026-46179
CVE-2026-46180 CVE-2026-46181 CVE-2026-46184 CVE-2026-46185 CVE-2026-46186
CVE-2026-46187 CVE-2026-46189 CVE-2026-46190 CVE-2026-46191 CVE-2026-46193
CVE-2026-46195 CVE-2026-46196 CVE-2026-46197 CVE-2026-46198 CVE-2026-46199
CVE-2026-46200 CVE-2026-46201 CVE-2026-46204 CVE-2026-46205 CVE-2026-46206
CVE-2026-46207 CVE-2026-46209 CVE-2026-46211 CVE-2026-46212 CVE-2026-46214
CVE-2026-46216 CVE-2026-46218 CVE-2026-46219 CVE-2026-46220 CVE-2026-46225
CVE-2026-46226 CVE-2026-46227 CVE-2026-46229 CVE-2026-46230 CVE-2026-46231
CVE-2026-46232 CVE-2026-46233 CVE-2026-46234 CVE-2026-46235 CVE-2026-46236
CVE-2026-46238 CVE-2026-46241 CVE-2026-46242 CVE-2026-46243 CVE-2026-46244
CVE-2026-46245 CVE-2026-46246 CVE-2026-46247 CVE-2026-46249 CVE-2026-46252
CVE-2026-46253 CVE-2026-46254 CVE-2026-46255 CVE-2026-46259 CVE-2026-46261
CVE-2026-46263 CVE-2026-46265 CVE-2026-46266 CVE-2026-46267 CVE-2026-46270
CVE-2026-46272 CVE-2026-46273 CVE-2026-46274 CVE-2026-46275 CVE-2026-46276
CVE-2026-46282 CVE-2026-46283 CVE-2026-46285 CVE-2026-46286 CVE-2026-46287
CVE-2026-46289 CVE-2026-46291 CVE-2026-46292 CVE-2026-46294 CVE-2026-46296
CVE-2026-46300 CVE-2026-46301 CVE-2026-46304 CVE-2026-46306 CVE-2026-46307
CVE-2026-46312 CVE-2026-46313 CVE-2026-46314 CVE-2026-46315 CVE-2026-46316
CVE-2026-46317 CVE-2026-46319 CVE-2026-46320 CVE-2026-46321 CVE-2026-46322
CVE-2026-46323 CVE-2026-46324 CVE-2026-46326 CVE-2026-46327 CVE-2026-46328
CVE-2026-46329 CVE-2026-46331 CVE-2026-46333 CVE-2026-46333 CVE-2026-46675
CVE-2026-4878 CVE-2026-50811 CVE-2026-52904 CVE-2026-52908 CVE-2026-52909
CVE-2026-52910 CVE-2026-52912 CVE-2026-52913 CVE-2026-52915 CVE-2026-52916
CVE-2026-52918 CVE-2026-52919 CVE-2026-52920 CVE-2026-52921 CVE-2026-52922
CVE-2026-52923 CVE-2026-52924 CVE-2026-52925 CVE-2026-52926 CVE-2026-52927
CVE-2026-52928 CVE-2026-52929 CVE-2026-52930 CVE-2026-52933 CVE-2026-52934
CVE-2026-52935 CVE-2026-52936 CVE-2026-52937 CVE-2026-52939 CVE-2026-52941
CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52947 CVE-2026-52948
CVE-2026-52951 CVE-2026-52953 CVE-2026-52954 CVE-2026-52955 CVE-2026-52956
CVE-2026-52957 CVE-2026-52958 CVE-2026-52959 CVE-2026-52962 CVE-2026-52963
CVE-2026-52964 CVE-2026-52967 CVE-2026-52969 CVE-2026-52970 CVE-2026-52972
CVE-2026-52974 CVE-2026-52975 CVE-2026-52976 CVE-2026-52977 CVE-2026-52980
CVE-2026-52981 CVE-2026-52982 CVE-2026-52984 CVE-2026-52986 CVE-2026-52988
CVE-2026-52989 CVE-2026-52990 CVE-2026-52991 CVE-2026-52993 CVE-2026-52994
CVE-2026-52995 CVE-2026-52998 CVE-2026-52999 CVE-2026-53000 CVE-2026-53001
CVE-2026-53002 CVE-2026-53003 CVE-2026-53004 CVE-2026-53005 CVE-2026-53006
CVE-2026-53009 CVE-2026-53011 CVE-2026-53012 CVE-2026-53013 CVE-2026-53014
CVE-2026-53015 CVE-2026-53016 CVE-2026-53021 CVE-2026-53022 CVE-2026-53031
CVE-2026-53032 CVE-2026-53033 CVE-2026-53034 CVE-2026-53035 CVE-2026-53036
CVE-2026-53037 CVE-2026-53038 CVE-2026-53039 CVE-2026-53040 CVE-2026-53041
CVE-2026-53045 CVE-2026-53047 CVE-2026-53048 CVE-2026-53049 CVE-2026-53050
CVE-2026-53051 CVE-2026-53052 CVE-2026-53053 CVE-2026-53056 CVE-2026-53058
CVE-2026-53059 CVE-2026-53060 CVE-2026-53061 CVE-2026-53062 CVE-2026-53063
CVE-2026-53064 CVE-2026-53065 CVE-2026-53066 CVE-2026-53068 CVE-2026-53069
CVE-2026-53070 CVE-2026-53071 CVE-2026-53072 CVE-2026-53073 CVE-2026-53074
CVE-2026-53075 CVE-2026-53076 CVE-2026-53077 CVE-2026-53078 CVE-2026-53080
CVE-2026-53081 CVE-2026-53082 CVE-2026-53083 CVE-2026-53084 CVE-2026-53085
CVE-2026-53086 CVE-2026-53088 CVE-2026-53089 CVE-2026-53090 CVE-2026-53091
CVE-2026-53092 CVE-2026-53093 CVE-2026-53094 CVE-2026-53096 CVE-2026-53097
CVE-2026-53098 CVE-2026-53099 CVE-2026-53101 CVE-2026-53102 CVE-2026-53103
CVE-2026-53104 CVE-2026-53105 CVE-2026-53106 CVE-2026-53107 CVE-2026-53109
CVE-2026-53110 CVE-2026-53111 CVE-2026-53112 CVE-2026-53113 CVE-2026-53114
CVE-2026-53121 CVE-2026-53122 CVE-2026-53123 CVE-2026-53126 CVE-2026-53129
CVE-2026-53131 CVE-2026-53132 CVE-2026-53133 CVE-2026-53134 CVE-2026-53135
CVE-2026-53136 CVE-2026-53137 CVE-2026-53138 CVE-2026-53139 CVE-2026-53140
CVE-2026-53142 CVE-2026-53143 CVE-2026-53144 CVE-2026-53146 CVE-2026-53147
CVE-2026-53148 CVE-2026-53149 CVE-2026-53150 CVE-2026-53152 CVE-2026-53154
CVE-2026-53156 CVE-2026-53157 CVE-2026-53158 CVE-2026-53159 CVE-2026-53160
CVE-2026-53161 CVE-2026-53163 CVE-2026-53167 CVE-2026-53168 CVE-2026-53175
CVE-2026-53176 CVE-2026-53177 CVE-2026-53178 CVE-2026-53180 CVE-2026-53181
CVE-2026-53182 CVE-2026-53183 CVE-2026-53184 CVE-2026-53185 CVE-2026-53186
CVE-2026-53189 CVE-2026-53190 CVE-2026-53191 CVE-2026-53192 CVE-2026-53193
CVE-2026-53194 CVE-2026-53195 CVE-2026-53196 CVE-2026-53199 CVE-2026-53202
CVE-2026-53203 CVE-2026-53205 CVE-2026-53207 CVE-2026-53208 CVE-2026-53209
CVE-2026-53210 CVE-2026-53212 CVE-2026-53213 CVE-2026-53214 CVE-2026-53215
CVE-2026-53216 CVE-2026-53217 CVE-2026-53218 CVE-2026-53219 CVE-2026-53220
CVE-2026-53221 CVE-2026-53223 CVE-2026-53224 CVE-2026-53225 CVE-2026-53226
CVE-2026-53227 CVE-2026-53228 CVE-2026-53229 CVE-2026-53230 CVE-2026-53233
CVE-2026-53235 CVE-2026-53236 CVE-2026-53237 CVE-2026-53238 CVE-2026-53239
CVE-2026-53241 CVE-2026-53242 CVE-2026-53245 CVE-2026-53246 CVE-2026-53247
CVE-2026-53249 CVE-2026-53250 CVE-2026-53251 CVE-2026-53252 CVE-2026-53253
CVE-2026-53254 CVE-2026-53255 CVE-2026-53256 CVE-2026-53258 CVE-2026-53260
CVE-2026-53262 CVE-2026-53263 CVE-2026-53264 CVE-2026-53265 CVE-2026-53266
CVE-2026-53267 CVE-2026-53268 CVE-2026-53269 CVE-2026-53270 CVE-2026-53272
CVE-2026-53273 CVE-2026-53274 CVE-2026-53275 CVE-2026-53277 CVE-2026-53279
CVE-2026-53281 CVE-2026-53284 CVE-2026-53285 CVE-2026-53286 CVE-2026-53287
CVE-2026-53289 CVE-2026-53291 CVE-2026-53293 CVE-2026-53297 CVE-2026-53306
CVE-2026-53309 CVE-2026-53313 CVE-2026-53317 CVE-2026-53318 CVE-2026-53321
CVE-2026-53324 CVE-2026-53325 CVE-2026-53329 CVE-2026-53330 CVE-2026-53331
CVE-2026-53332 CVE-2026-53336 CVE-2026-53337 CVE-2026-53339 CVE-2026-53341
CVE-2026-53345 CVE-2026-53347 CVE-2026-53350 CVE-2026-53353 CVE-2026-53355
CVE-2026-53356 CVE-2026-53357 CVE-2026-53358 CVE-2026-53359 CVE-2026-53359
CVE-2026-53360 CVE-2026-53362 CVE-2026-53365 CVE-2026-53366 CVE-2026-53369
CVE-2026-53374 CVE-2026-53375 CVE-2026-53376 CVE-2026-53377 CVE-2026-53379
CVE-2026-53381 CVE-2026-53382 CVE-2026-53384 CVE-2026-53385 CVE-2026-53386
CVE-2026-53387 CVE-2026-53388 CVE-2026-53388 CVE-2026-53391 CVE-2026-53392
CVE-2026-53393 CVE-2026-53394 CVE-2026-53397 CVE-2026-53398 CVE-2026-53399
CVE-2026-53400 CVE-2026-53402 CVE-2026-53403 CVE-2026-53612 CVE-2026-53613
CVE-2026-53614 CVE-2026-5435 CVE-2026-54369 CVE-2026-54370 CVE-2026-54371
CVE-2026-54411 CVE-2026-5450 CVE-2026-54872 CVE-2026-54874 CVE-2026-54875
CVE-2026-57432 CVE-2026-5928 CVE-2026-5958 CVE-2026-6238 CVE-2026-63072
CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368
CVE-2026-63794 CVE-2026-63795 CVE-2026-63801 CVE-2026-63802 CVE-2026-63803
CVE-2026-63804 CVE-2026-63806 CVE-2026-63807 CVE-2026-63808 CVE-2026-63809
CVE-2026-63810 CVE-2026-63821 CVE-2026-63822 CVE-2026-63823 CVE-2026-63824
CVE-2026-63826 CVE-2026-63827 CVE-2026-63828 CVE-2026-63829 CVE-2026-63831
CVE-2026-63836 CVE-2026-63838 CVE-2026-63842 CVE-2026-63843 CVE-2026-63844
CVE-2026-63845 CVE-2026-63846 CVE-2026-63847 CVE-2026-63848 CVE-2026-63850
CVE-2026-63851 CVE-2026-63852 CVE-2026-63853 CVE-2026-63854 CVE-2026-63855
CVE-2026-63856 CVE-2026-63860 CVE-2026-63861 CVE-2026-63862 CVE-2026-63865
CVE-2026-63868 CVE-2026-63869 CVE-2026-63871 CVE-2026-63875 CVE-2026-63879
CVE-2026-63881 CVE-2026-63882 CVE-2026-63883 CVE-2026-63884 CVE-2026-63886
CVE-2026-63887 CVE-2026-63888 CVE-2026-63889 CVE-2026-63890 CVE-2026-63891
CVE-2026-63892 CVE-2026-63893 CVE-2026-63894 CVE-2026-63895 CVE-2026-63896
CVE-2026-63897 CVE-2026-63898 CVE-2026-63899 CVE-2026-63900 CVE-2026-63901
CVE-2026-63902 CVE-2026-63903 CVE-2026-63904 CVE-2026-63905 CVE-2026-63906
CVE-2026-63908 CVE-2026-63912 CVE-2026-63913 CVE-2026-63915 CVE-2026-63916
CVE-2026-63917 CVE-2026-63918 CVE-2026-63919 CVE-2026-63920 CVE-2026-63921
CVE-2026-63922 CVE-2026-63923 CVE-2026-63924 CVE-2026-63925 CVE-2026-63926
CVE-2026-63927 CVE-2026-63928 CVE-2026-63928 CVE-2026-63929 CVE-2026-63930
CVE-2026-63931 CVE-2026-63933 CVE-2026-63934 CVE-2026-63936 CVE-2026-63937
CVE-2026-63938 CVE-2026-63939 CVE-2026-63940 CVE-2026-63941 CVE-2026-63942
CVE-2026-63943 CVE-2026-63944 CVE-2026-63945 CVE-2026-63946 CVE-2026-63947
CVE-2026-63948 CVE-2026-63949 CVE-2026-63952 CVE-2026-63956 CVE-2026-63957
CVE-2026-63958 CVE-2026-63959 CVE-2026-63960 CVE-2026-63961 CVE-2026-63962
CVE-2026-63963 CVE-2026-63964 CVE-2026-63967 CVE-2026-63968 CVE-2026-63969
CVE-2026-63970 CVE-2026-63971 CVE-2026-63972 CVE-2026-63973 CVE-2026-63974
CVE-2026-63975 CVE-2026-63976 CVE-2026-63983 CVE-2026-63984 CVE-2026-63985
CVE-2026-63986 CVE-2026-63987 CVE-2026-63990 CVE-2026-63991 CVE-2026-63992
CVE-2026-63993 CVE-2026-63994 CVE-2026-63995 CVE-2026-63996 CVE-2026-63997
CVE-2026-63998 CVE-2026-63999 CVE-2026-64000 CVE-2026-64001 CVE-2026-64002
CVE-2026-64003 CVE-2026-64004 CVE-2026-64005 CVE-2026-64006 CVE-2026-64007
CVE-2026-64009 CVE-2026-64010 CVE-2026-64011 CVE-2026-64014 CVE-2026-64015
CVE-2026-64017 CVE-2026-64018 CVE-2026-64021 CVE-2026-64024 CVE-2026-64025
CVE-2026-64029 CVE-2026-64033 CVE-2026-64034 CVE-2026-64039 CVE-2026-64046
CVE-2026-64047 CVE-2026-64048 CVE-2026-64051 CVE-2026-64052 CVE-2026-64053
CVE-2026-64054 CVE-2026-64055 CVE-2026-64056 CVE-2026-64061 CVE-2026-64070
CVE-2026-64071 CVE-2026-64073 CVE-2026-64083 CVE-2026-64084 CVE-2026-64085
CVE-2026-64086 CVE-2026-64087 CVE-2026-64088 CVE-2026-64089 CVE-2026-64091
CVE-2026-64093 CVE-2026-64097 CVE-2026-64098 CVE-2026-64099 CVE-2026-64102
CVE-2026-64103 CVE-2026-64104 CVE-2026-64105 CVE-2026-64106 CVE-2026-64109
CVE-2026-64111 CVE-2026-64112 CVE-2026-64113 CVE-2026-64114 CVE-2026-64115
CVE-2026-64118 CVE-2026-64119 CVE-2026-64121 CVE-2026-64125 CVE-2026-64126
CVE-2026-64127 CVE-2026-64128 CVE-2026-64131 CVE-2026-64132 CVE-2026-64133
CVE-2026-64134 CVE-2026-64135 CVE-2026-64137 CVE-2026-64144 CVE-2026-64146
CVE-2026-64147 CVE-2026-64148 CVE-2026-64154 CVE-2026-64155 CVE-2026-64157
CVE-2026-64158 CVE-2026-64162 CVE-2026-64164 CVE-2026-64166 CVE-2026-64168
CVE-2026-64169 CVE-2026-64170 CVE-2026-64173 CVE-2026-64174 CVE-2026-64177
CVE-2026-64178 CVE-2026-64179 CVE-2026-64180 CVE-2026-64182 CVE-2026-64183
CVE-2026-64184 CVE-2026-64185 CVE-2026-64187 CVE-2026-64188 CVE-2026-64189
CVE-2026-64190 CVE-2026-64191 CVE-2026-64192 CVE-2026-64205 CVE-2026-64210
CVE-2026-64214 CVE-2026-64216 CVE-2026-64217 CVE-2026-64219 CVE-2026-64220
CVE-2026-64221 CVE-2026-64222 CVE-2026-64223 CVE-2026-64224 CVE-2026-64225
CVE-2026-64231 CVE-2026-64232 CVE-2026-64233 CVE-2026-64234 CVE-2026-64235
CVE-2026-64237 CVE-2026-64239 CVE-2026-64240 CVE-2026-64241 CVE-2026-64242
CVE-2026-64243 CVE-2026-64244 CVE-2026-64245 CVE-2026-64246 CVE-2026-64247
CVE-2026-64249 CVE-2026-64253 CVE-2026-64256 CVE-2026-64265 CVE-2026-64266
CVE-2026-64268 CVE-2026-64269 CVE-2026-64270 CVE-2026-64271 CVE-2026-64272
CVE-2026-64273 CVE-2026-64274 CVE-2026-64275 CVE-2026-64276 CVE-2026-64277
CVE-2026-64278 CVE-2026-64279 CVE-2026-64283 CVE-2026-64286 CVE-2026-64287
CVE-2026-64294 CVE-2026-64296 CVE-2026-64297 CVE-2026-64298 CVE-2026-64299
CVE-2026-64300 CVE-2026-64301 CVE-2026-64303 CVE-2026-64304 CVE-2026-64305
CVE-2026-64306 CVE-2026-64307 CVE-2026-64308 CVE-2026-64309 CVE-2026-64310
CVE-2026-64312 CVE-2026-64313 CVE-2026-64315 CVE-2026-64316 CVE-2026-64317
CVE-2026-64319 CVE-2026-64320 CVE-2026-64321 CVE-2026-64322 CVE-2026-64323
CVE-2026-64324 CVE-2026-64326 CVE-2026-64327 CVE-2026-64328 CVE-2026-64329
CVE-2026-64330 CVE-2026-64331 CVE-2026-64332 CVE-2026-64333 CVE-2026-64334
CVE-2026-64335 CVE-2026-64336 CVE-2026-64337 CVE-2026-64338 CVE-2026-64340
CVE-2026-64341 CVE-2026-64342 CVE-2026-64343 CVE-2026-64344 CVE-2026-64345
CVE-2026-64346 CVE-2026-64347 CVE-2026-64348 CVE-2026-64350 CVE-2026-64351
CVE-2026-64354 CVE-2026-64355 CVE-2026-64357 CVE-2026-64358 CVE-2026-64362
CVE-2026-64364 CVE-2026-64365 CVE-2026-64367 CVE-2026-64368 CVE-2026-64372
CVE-2026-64373 CVE-2026-64375 CVE-2026-64376 CVE-2026-64377 CVE-2026-64378
CVE-2026-64380 CVE-2026-64381 CVE-2026-64382 CVE-2026-64383 CVE-2026-64384
CVE-2026-64385 CVE-2026-64386 CVE-2026-64387 CVE-2026-64388 CVE-2026-64401
CVE-2026-64402 CVE-2026-64403 CVE-2026-64404 CVE-2026-64405 CVE-2026-64406
CVE-2026-64407 CVE-2026-64408 CVE-2026-64409 CVE-2026-64411 CVE-2026-64412
CVE-2026-64414 CVE-2026-64415 CVE-2026-64416 CVE-2026-64418 CVE-2026-64420
CVE-2026-64421 CVE-2026-64422 CVE-2026-64423 CVE-2026-64427 CVE-2026-64429
CVE-2026-64433 CVE-2026-64434 CVE-2026-64436 CVE-2026-64440 CVE-2026-64442
CVE-2026-64443 CVE-2026-64444 CVE-2026-64445 CVE-2026-64446 CVE-2026-64448
CVE-2026-64450 CVE-2026-64452 CVE-2026-64454 CVE-2026-64455 CVE-2026-64456
CVE-2026-64457 CVE-2026-64458 CVE-2026-64463 CVE-2026-64465 CVE-2026-64470
CVE-2026-64471 CVE-2026-64472 CVE-2026-64473 CVE-2026-64474 CVE-2026-64475
CVE-2026-64476 CVE-2026-64477 CVE-2026-64478 CVE-2026-64479 CVE-2026-64480
CVE-2026-64481 CVE-2026-64482 CVE-2026-64483 CVE-2026-64484 CVE-2026-64486
CVE-2026-64487 CVE-2026-64489 CVE-2026-64490 CVE-2026-64494 CVE-2026-64495
CVE-2026-64496 CVE-2026-64497 CVE-2026-64499 CVE-2026-64500 CVE-2026-64503
CVE-2026-64504 CVE-2026-64505 CVE-2026-64507 CVE-2026-64511 CVE-2026-64512
CVE-2026-64513 CVE-2026-64515 CVE-2026-64517 CVE-2026-64518 CVE-2026-64519
CVE-2026-64524 CVE-2026-64525 CVE-2026-64526 CVE-2026-64527 CVE-2026-64528
CVE-2026-64530 CVE-2026-64534 CVE-2026-64535 CVE-2026-64536 CVE-2026-64537
CVE-2026-64538 CVE-2026-64539 CVE-2026-64540 CVE-2026-64541 CVE-2026-64542
CVE-2026-64543 CVE-2026-64544 CVE-2026-64545 CVE-2026-64546 CVE-2026-64547
CVE-2026-64548 CVE-2026-64549 CVE-2026-64551 CVE-2026-64552 CVE-2026-64553
CVE-2026-64554 CVE-2026-64555 CVE-2026-64556 CVE-2026-64558 CVE-2026-64559
CVE-2026-64560 CVE-2026-64561 CVE-2026-64561 CVE-2026-64562 CVE-2026-64563
CVE-2026-64564 CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569
CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573 CVE-2026-64574
CVE-2026-64576 CVE-2026-64577 CVE-2026-64579 CVE-2026-64580 CVE-2026-64581
CVE-2026-64582 CVE-2026-64583 CVE-2026-64584 CVE-2026-64585 CVE-2026-64586
CVE-2026-64589 CVE-2026-64593 CVE-2026-64594 CVE-2026-64597 CVE-2026-64598
CVE-2026-64599 CVE-2026-64600 CVE-2026-64602 CVE-2026-64603 CVE-2026-64604
CVE-2026-6732 CVE-2026-6791 CVE-2026-68081 CVE-2026-68082 CVE-2026-68085
CVE-2026-68086 CVE-2026-68088 CVE-2026-68091 CVE-2026-68093 CVE-2026-68096
CVE-2026-68102 CVE-2026-68104 CVE-2026-68105 CVE-2026-68106 CVE-2026-68107
CVE-2026-68108 CVE-2026-68110 CVE-2026-68111 CVE-2026-68112 CVE-2026-68113
CVE-2026-68115 CVE-2026-68116 CVE-2026-68117 CVE-2026-68120 CVE-2026-68121
CVE-2026-68123 CVE-2026-68124 CVE-2026-68125 CVE-2026-68126 CVE-2026-68127
CVE-2026-68128 CVE-2026-68129 CVE-2026-68132 CVE-2026-68133 CVE-2026-68135
CVE-2026-68136 CVE-2026-68137 CVE-2026-68138 CVE-2026-68139 CVE-2026-68141
CVE-2026-68142 CVE-2026-68143 CVE-2026-68144 CVE-2026-68145 CVE-2026-68146
CVE-2026-68148 CVE-2026-68149 CVE-2026-68152 CVE-2026-68153 CVE-2026-68154
CVE-2026-68155 CVE-2026-68156 CVE-2026-68157 CVE-2026-68158 CVE-2026-68159
CVE-2026-68161 CVE-2026-68162 CVE-2026-68164 CVE-2026-68165 CVE-2026-68166
CVE-2026-68169 CVE-2026-68178 CVE-2026-68179 CVE-2026-68180 CVE-2026-68181
CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68188 CVE-2026-68189
CVE-2026-68192 CVE-2026-68193 CVE-2026-68194 CVE-2026-68195 CVE-2026-68196
CVE-2026-68197 CVE-2026-68198 CVE-2026-68199 CVE-2026-68200 CVE-2026-68201
CVE-2026-68202 CVE-2026-68203 CVE-2026-68204 CVE-2026-68205 CVE-2026-68206
CVE-2026-68207 CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213
CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217 CVE-2026-68218
CVE-2026-68219 CVE-2026-68220 CVE-2026-68221 CVE-2026-68222 CVE-2026-68223
CVE-2026-68225 CVE-2026-68226 CVE-2026-68227 CVE-2026-68228 CVE-2026-68229
CVE-2026-68231 CVE-2026-68234 CVE-2026-68235 CVE-2026-68236 CVE-2026-68238
CVE-2026-68243 CVE-2026-68244 CVE-2026-68245 CVE-2026-68246 CVE-2026-68247
CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68252
CVE-2026-68253 CVE-2026-68254 CVE-2026-68255 CVE-2026-68256 CVE-2026-68257
CVE-2026-68258 CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262
CVE-2026-68263 CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68269
CVE-2026-68271 CVE-2026-68272 CVE-2026-68273 CVE-2026-68277 CVE-2026-68278
CVE-2026-68279 CVE-2026-68280 CVE-2026-68281 CVE-2026-68284 CVE-2026-68286
CVE-2026-68288 CVE-2026-68289 CVE-2026-68290 CVE-2026-68293 CVE-2026-68294
CVE-2026-68296 CVE-2026-68297 CVE-2026-68299 CVE-2026-68300 CVE-2026-68302
CVE-2026-68303 CVE-2026-68304 CVE-2026-68306 CVE-2026-68307 CVE-2026-68308
CVE-2026-68309 CVE-2026-68310 CVE-2026-68311 CVE-2026-68312 CVE-2026-68313
CVE-2026-68315 CVE-2026-68319 CVE-2026-68320 CVE-2026-68321 CVE-2026-68322
CVE-2026-68325 CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68329
CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336 CVE-2026-68338
CVE-2026-68339 CVE-2026-68340 CVE-2026-68343 CVE-2026-68344 CVE-2026-68346
CVE-2026-68348 CVE-2026-68349 CVE-2026-68350 CVE-2026-68351 CVE-2026-68352
CVE-2026-68353 CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68358
CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363
CVE-2026-68365 CVE-2026-68366 CVE-2026-68367 CVE-2026-68368 CVE-2026-68369
CVE-2026-68370 CVE-2026-68371 CVE-2026-68372 CVE-2026-68373 CVE-2026-68374
CVE-2026-68375 CVE-2026-68376 CVE-2026-68377 CVE-2026-68382 CVE-2026-68385
CVE-2026-68386 CVE-2026-68389 CVE-2026-68391 CVE-2026-68392 CVE-2026-68393
CVE-2026-68394 CVE-2026-68395 CVE-2026-68397 CVE-2026-68398 CVE-2026-68399
CVE-2026-68400 CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406
CVE-2026-68407 CVE-2026-68408 CVE-2026-68410 CVE-2026-68413 CVE-2026-68414
CVE-2026-68416 CVE-2026-68417 CVE-2026-68418 CVE-2026-68419 CVE-2026-68422
CVE-2026-68425 CVE-2026-68426 CVE-2026-68427 CVE-2026-68428 CVE-2026-68429
CVE-2026-68430 CVE-2026-68432 CVE-2026-68433 CVE-2026-68434 CVE-2026-68437
CVE-2026-68439 CVE-2026-68441 CVE-2026-68442 CVE-2026-68443 CVE-2026-68444
CVE-2026-68445 CVE-2026-68446 CVE-2026-68448 CVE-2026-68450 CVE-2026-68451
CVE-2026-68452 CVE-2026-68454 CVE-2026-68470 CVE-2026-68471 CVE-2026-68477
CVE-2026-68480 CVE-2026-72012 CVE-2026-72017 CVE-2026-72018 CVE-2026-72019
CVE-2026-72020 CVE-2026-72022 CVE-2026-72023 CVE-2026-72025 CVE-2026-72032
CVE-2026-72034 CVE-2026-72035 CVE-2026-72036 CVE-2026-72045 CVE-2026-72046
CVE-2026-72051 CVE-2026-72052 CVE-2026-72053 CVE-2026-72054 CVE-2026-72055
CVE-2026-72061 CVE-2026-72066 CVE-2026-72069 CVE-2026-72070 CVE-2026-72072
CVE-2026-72083 CVE-2026-72084 CVE-2026-72098 CVE-2026-72100 CVE-2026-72101
CVE-2026-72102 CVE-2026-72103 CVE-2026-72106 CVE-2026-72107 CVE-2026-72108
CVE-2026-72128 CVE-2026-72129 CVE-2026-72130 CVE-2026-72132 CVE-2026-72136
CVE-2026-72137 CVE-2026-72147 CVE-2026-72161 CVE-2026-72163 CVE-2026-72164
CVE-2026-72166 CVE-2026-72176 CVE-2026-72177 CVE-2026-72217 CVE-2026-72218
CVE-2026-72219 CVE-2026-72221 CVE-2026-72222 CVE-2026-72224 CVE-2026-72234
CVE-2026-72237 CVE-2026-72242 CVE-2026-72243 CVE-2026-72247 CVE-2026-72251
CVE-2026-72254 CVE-2026-72256 CVE-2026-72280 CVE-2026-72282 CVE-2026-72288
CVE-2026-72289 CVE-2026-72296 CVE-2026-72297 CVE-2026-72299 CVE-2026-72306
CVE-2026-72307 CVE-2026-72308 CVE-2026-72317 CVE-2026-72321 CVE-2026-72322
CVE-2026-72323 CVE-2026-72325 CVE-2026-72330 CVE-2026-72337 CVE-2026-72339
CVE-2026-72341 CVE-2026-72342 CVE-2026-72343 CVE-2026-72345 CVE-2026-72347
CVE-2026-72348 CVE-2026-72349 CVE-2026-72350 CVE-2026-72351 CVE-2026-72352
CVE-2026-72366 CVE-2026-72379 CVE-2026-72383 CVE-2026-72389 CVE-2026-72392
CVE-2026-72398 CVE-2026-72399 CVE-2026-72404 CVE-2026-72406 CVE-2026-72413
CVE-2026-72414 CVE-2026-72421 CVE-2026-72425 CVE-2026-72430 CVE-2026-72433
CVE-2026-72434 CVE-2026-72435 CVE-2026-72436 CVE-2026-72437 CVE-2026-72438
CVE-2026-72439 CVE-2026-72440 CVE-2026-72444 CVE-2026-72447 CVE-2026-72448
CVE-2026-72450 CVE-2026-72459 CVE-2026-72460 CVE-2026-72464 CVE-2026-72466
CVE-2026-72467 CVE-2026-72468 CVE-2026-72469 CVE-2026-72473 CVE-2026-72485
CVE-2026-72487 CVE-2026-72488 CVE-2026-72491 CVE-2026-72494 CVE-2026-72495
CVE-2026-72497 CVE-2026-72499 CVE-2026-72500 CVE-2026-72501 CVE-2026-72502
CVE-2026-72897 CVE-2026-7383 CVE-2026-74255 CVE-2026-74256 CVE-2026-74257
CVE-2026-74258 CVE-2026-74261 CVE-2026-74267 CVE-2026-74268 CVE-2026-74269
CVE-2026-74270 CVE-2026-74281 CVE-2026-74282 CVE-2026-74283 CVE-2026-74284
CVE-2026-74286 CVE-2026-74288 CVE-2026-74289 CVE-2026-74290 CVE-2026-74296
CVE-2026-74297 CVE-2026-74307 CVE-2026-74308 CVE-2026-74313 CVE-2026-74316
CVE-2026-74317 CVE-2026-74318 CVE-2026-74321 CVE-2026-74330 CVE-2026-74334
CVE-2026-74345 CVE-2026-74346 CVE-2026-74349 CVE-2026-74356 CVE-2026-74359
CVE-2026-74363 CVE-2026-74365 CVE-2026-74375 CVE-2026-74376 CVE-2026-74377
CVE-2026-74378 CVE-2026-74382 CVE-2026-74384 CVE-2026-74385 CVE-2026-74386
CVE-2026-74388 CVE-2026-74389 CVE-2026-74390 CVE-2026-74391 CVE-2026-74394
CVE-2026-74395 CVE-2026-74397 CVE-2026-74398 CVE-2026-74406 CVE-2026-74440
CVE-2026-74449 CVE-2026-74450 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467
CVE-2026-74469 CVE-2026-74471 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475
CVE-2026-74476 CVE-2026-74479 CVE-2026-74480 CVE-2026-74481 CVE-2026-74482
CVE-2026-74483 CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74490
CVE-2026-74492 CVE-2026-74493 CVE-2026-74495 CVE-2026-74496 CVE-2026-74510
CVE-2026-74512 CVE-2026-74513 CVE-2026-74515 CVE-2026-74517 CVE-2026-74518
CVE-2026-74523 CVE-2026-74527 CVE-2026-74533 CVE-2026-74534 CVE-2026-74535
CVE-2026-74536 CVE-2026-74537 CVE-2026-74538 CVE-2026-74545 CVE-2026-74548
CVE-2026-74550 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563
CVE-2026-74564 CVE-2026-74566 CVE-2026-74567 CVE-2026-74571 CVE-2026-74577
CVE-2026-74579 CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74584
CVE-2026-74586 CVE-2026-74588 CVE-2026-74589 CVE-2026-74590 CVE-2026-74592
CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74600
CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74605 CVE-2026-74606
CVE-2026-74609 CVE-2026-74610 CVE-2026-74612 CVE-2026-74615 CVE-2026-74616
CVE-2026-74622 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630 CVE-2026-74631
CVE-2026-74632 CVE-2026-74634 CVE-2026-74636 CVE-2026-74637 CVE-2026-74638
CVE-2026-74644 CVE-2026-74659 CVE-2026-74660 CVE-2026-74662 CVE-2026-74663
CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74669 CVE-2026-74671
CVE-2026-74688 CVE-2026-74689 CVE-2026-74692 CVE-2026-74694 CVE-2026-74695
CVE-2026-74696 CVE-2026-74697 CVE-2026-74700 CVE-2026-74701 CVE-2026-74705
CVE-2026-74710 CVE-2026-74712 CVE-2026-74713 CVE-2026-74717 CVE-2026-74718
CVE-2026-74719 CVE-2026-74722 CVE-2026-74723 CVE-2026-74725 CVE-2026-74726
CVE-2026-74730 CVE-2026-74735 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743
CVE-2026-74744 CVE-2026-74745 CVE-2026-74752 CVE-2026-75803 CVE-2026-75804
CVE-2026-75805 CVE-2026-75806 CVE-2026-76642 CVE-2026-77117 CVE-2026-77696
CVE-2026-78408 CVE-2026-78410 CVE-2026-80489 CVE-2026-80521 CVE-2026-80529
CVE-2026-80530 CVE-2026-80531 CVE-2026-80533 CVE-2026-80534 CVE-2026-80535
CVE-2026-80557 CVE-2026-80558 CVE-2026-80561 CVE-2026-80585 CVE-2026-80586
CVE-2026-80589 CVE-2026-80590 CVE-2026-80603 CVE-2026-80609 CVE-2026-80613
CVE-2026-80629 CVE-2026-80631 CVE-2026-80646 CVE-2026-80647 CVE-2026-80664
CVE-2026-80667 CVE-2026-80679 CVE-2026-80681 CVE-2026-80686 CVE-2026-80693
CVE-2026-80694 CVE-2026-80714 CVE-2026-80715 CVE-2026-80721 CVE-2026-80725
CVE-2026-80727 CVE-2026-80731 CVE-2026-80737 CVE-2026-80739 CVE-2026-80747
CVE-2026-80756 CVE-2026-80779 CVE-2026-80789 CVE-2026-80793 CVE-2026-80805
CVE-2026-80813 CVE-2026-80836 CVE-2026-80838 CVE-2026-80840 CVE-2026-80841
CVE-2026-80842 CVE-2026-80844 CVE-2026-80846 CVE-2026-80847 CVE-2026-80848
CVE-2026-80851 CVE-2026-80852 CVE-2026-80863 CVE-2026-80864 CVE-2026-80865
CVE-2026-80880 CVE-2026-80895 CVE-2026-80932 CVE-2026-80976 CVE-2026-80979
CVE-2026-80980 CVE-2026-80983 CVE-2026-80984 CVE-2026-81000 CVE-2026-81001
CVE-2026-8376 CVE-2026-84782 CVE-2026-84784 CVE-2026-86145 CVE-2026-8674
CVE-2026-86805 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160
CVE-2026-89161 CVE-2026-89162 CVE-2026-89448 CVE-2026-89451 CVE-2026-89453
CVE-2026-89477 CVE-2026-89479 CVE-2026-89480 CVE-2026-89481 CVE-2026-89482
CVE-2026-89485 CVE-2026-89500 CVE-2026-89501 CVE-2026-89502 CVE-2026-89503
CVE-2026-89508 CVE-2026-89510 CVE-2026-89511 CVE-2026-89525 CVE-2026-89526
CVE-2026-89527 CVE-2026-89530 CVE-2026-89531 CVE-2026-89532 CVE-2026-89533
CVE-2026-89534 CVE-2026-89535 CVE-2026-89536 CVE-2026-89538 CVE-2026-89539
CVE-2026-89540 CVE-2026-89541 CVE-2026-89542 CVE-2026-89544 CVE-2026-89545
CVE-2026-89547 CVE-2026-89548 CVE-2026-89550 CVE-2026-89551 CVE-2026-89564
CVE-2026-89569 CVE-2026-89580 CVE-2026-89603 CVE-2026-89644 CVE-2026-89658
CVE-2026-89660 CVE-2026-89662 CVE-2026-89663 CVE-2026-89665 CVE-2026-89669
CVE-2026-89671 CVE-2026-89672 CVE-2026-89673 CVE-2026-89674 CVE-2026-89680
CVE-2026-89683 CVE-2026-89684 CVE-2026-89685 CVE-2026-89686 CVE-2026-89688
CVE-2026-89690 CVE-2026-89691 CVE-2026-89694 CVE-2026-89696 CVE-2026-89697
CVE-2026-89698 CVE-2026-89699 CVE-2026-89702 CVE-2026-89703 CVE-2026-89704
CVE-2026-89705 CVE-2026-89706 CVE-2026-89707 CVE-2026-89710 CVE-2026-89712
CVE-2026-89713 CVE-2026-89747 CVE-2026-89780 CVE-2026-89784 CVE-2026-89789
CVE-2026-89791 CVE-2026-89798 CVE-2026-89912 CVE-2026-89913 CVE-2026-89968
CVE-2026-89970 CVE-2026-89984 CVE-2026-90003 CVE-2026-90065 CVE-2026-90074
CVE-2026-90097 CVE-2026-90101 CVE-2026-90104 CVE-2026-90142 CVE-2026-90149
CVE-2026-90150 CVE-2026-90151 CVE-2026-90177 CVE-2026-90182 CVE-2026-90183
CVE-2026-90203 CVE-2026-90218 CVE-2026-90228 CVE-2026-90240 CVE-2026-90241
CVE-2026-90243 CVE-2026-90259 CVE-2026-90263 CVE-2026-90265 CVE-2026-90292
CVE-2026-90293 CVE-2026-90294 CVE-2026-90307 CVE-2026-90308 CVE-2026-90309
CVE-2026-90358 CVE-2026-90388 CVE-2026-90413 CVE-2026-90414 CVE-2026-90415
CVE-2026-90417 CVE-2026-90426 CVE-2026-90428 CVE-2026-90430 CVE-2026-9076
CVE-2026-92495 CVE-2026-92523 CVE-2026-92525 CVE-2026-93037 CVE-2026-93107
CVE-2026-93108 CVE-2026-93109 CVE-2026-93110 CVE-2026-93154 CVE-2026-93160
CVE-2026-93207 CVE-2026-93212 CVE-2026-93264 CVE-2026-93782 CVE-2026-93794
CVE-2026-93800 CVE-2026-93810 CVE-2026-93814 CVE-2026-93825 CVE-2026-93826
CVE-2026-93827 CVE-2026-93829 CVE-2026-97413 CVE-2026-97421 CVE-2026-97477
CVE-2026-97520 CVE-2026-97521 CVE-2026-97543 CVE-2026-97544 CVE-2026-97545
CVE-2026-97546 CVE-2026-97552 CVE-2026-97557 CVE-2026-97571 CVE-2026-97572
CVE-2026-97573 CVE-2026-97574 CVE-2026-97605 CVE-2026-97902 CVE-2026-97934
CVE-2026-97940 CVE-2026-97947 CVE-2026-97957 CVE-2026-98003 CVE-2026-98028
CVE-2026-98029 CVE-2026-98030 CVE-2026-98091
-----------------------------------------------------------------
The container elemental/base-os-kernel-default was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 50
Released: Tue Nov 25 08:35:00 2025
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1215199,1218644,1230062,1234634,1234693,1234863,1235953,1236897,1237108,1237131,1237542,1237776,1238972,1239206,1240324,1240696,1240966,1240998,1241166,1241353,1241403,1241435,1242034,1242086,1242414,1242782,1242864,1242965,1242995,1243000,1243055,1243068,1243100,1243112,1243774,1244309,1244723,1244734,1244749,1244792,1244812,1244930,1244939,1245000,1245151,1245193,1245206,1245216,1245260,1245410,1245457,1245504,1245506,1245508,1245510,1245596,1245621,1245630,1245654,1245657,1245658,1245659,1245663,1245664,1245665,1245666,1245668,1245669,1245670,1245671,1245675,1245676,1245678,1245683,1245684,1245686,1245688,1245690,1245691,1245695,1245700,1245703,1245705,1245710,1245711,1245713,1245714,1245715,1245717,1245719,1245721,1245723,1245726,1245728,1245729,1245730,1245731,1245735,1245737,1245744,1245745,1245746,1245747,1245748,1245749,1245751,1245757,1245763,1245765,1245767,1245769,1245777,1245780,1245781,1245784,1245785,1245787,1245812,1245814,1245815,1245937,1245945,1245952,1
245955,1245956,1245963,1245966,1245970,1245973,1245976,1245977,1245986,1246000,1246002,1246005,1246008,1246012,1246022,1246023,1246031,1246034,1246037,1246041,1246042,1246047,1246049,1246050,1246053,1246054,1246055,1246057,1246098,1246109,1246125,1246166,1246171,1246176,1246181,1246183,1246185,1246186,1246188,1246190,1246192,1246193,1246195,1246220,1246234,1246236,1246240,1246243,1246244,1246245,1246246,1246248,1246250,1246252,1246253,1246255,1246258,1246259,1246260,1246262,1246266,1246268,1246283,1246285,1246286,1246287,1246290,1246292,1246293,1246295,1246297,1246333,1246334,1246337,1246342,1246349,1246351,1246353,1246354,1246358,1246364,1246366,1246370,1246375,1246376,1246385,1246386,1246387,1246438,1246443,1246444,1246447,1246450,1246453,1246473,1246490,1246509,1246547,1246631,1246651,1246688,1246777,1246781,1246782,1246868,1246896,1246911,1246979,1247018,1247020,1247022,1247023,1247024,1247027,1247028,1247031,1247033,1247035,1247061,1247062,1247064,1247076,1247078,1247079,124708
8,1247089,1247091,1247097,1247098,1247099,1247101,1247102,1247103,1247104,1247112,1247113,1247116,1247118,1247119,1247123,1247125,1247126,1247128,1247130,1247131,1247132,1247136,1247137,1247138,1247141,1247143,1247145,1247146,1247147,1247149,1247150,1247151,1247152,1247153,1247154,1247155,1247156,1247157,1247160,1247162,1247163,1247164,1247167,1247169,1247170,1247171,1247174,1247176,1247177,1247178,1247181,1247209,1247210,1247220,1247223,1247227,1247229,1247231,1247233,1247234,1247235,1247236,1247238,1247239,1247241,1247243,1247250,1247251,1247252,1247253,1247255,1247262,1247265,1247270,1247271,1247273,1247274,1247276,1247277,1247278,1247279,1247280,1247282,1247283,1247284,1247285,1247288,1247289,1247290,1247293,1247308,1247311,1247313,1247314,1247317,1247325,1247347,1247348,1247349,1247366,1247372,1247376,1247426,1247437,1247442,1247483,1247500,1247712,1247837,1247838,1247935,1247936,1247949,1247950,1247963,1247976,1248088,1248111,1248121,1248183,1248186,1248190,1248192,1248194,124
8198,1248199,1248200,1248202,1248205,1248211,1248223,1248224,1248225,1248230,1248235,1248255,1248296,1248297,1248299,1248302,1248304,1248306,1248312,1248333,1248334,1248337,1248338,1248340,1248341,1248343,1248345,1248349,1248350,1248354,1248355,1248357,1248359,1248361,1248363,1248365,1248367,1248368,1248374,1248377,1248378,1248380,1248386,1248390,1248392,1248395,1248396,1248399,1248401,1248511,1248512,1248573,1248575,1248577,1248609,1248610,1248616,1248617,1248619,1248621,1248622,1248624,1248627,1248628,1248634,1248635,1248639,1248643,1248647,1248648,1248652,1248655,1248662,1248664,1248666,1248669,1248674,1248681,1248727,1248728,1248748,1248754,1248775,1249022,1249038,1249060,1249061,1249062,1249064,1249065,1249066,1249126,1249143,1249156,1249159,1249160,1249163,1249164,1249166,1249167,1249169,1249170,1249172,1249176,1249177,1249182,1249186,1249190,1249193,1249195,1249199,1249201,1249202,1249203,1249204,1249206,1249215,1249220,1249221,1249254,1249258,1249262,1249263,1249265,1249266,
1249269,1249271,1249272,1249273,1249274,1249278,1249279,1249281,1249282,1249284,1249285,1249286,1249288,1249290,1249292,1249295,1249296,1249297,1249299,1249300,1249301,1249303,1249304,1249305,1249306,1249308,1249309,1249312,1249313,1249314,1249315,1249316,1249318,1249319,1249320,1249321,1249322,1249323,1249324,1249333,1249334,1249338,1249346,1249374,1249413,1249477,1249478,1249479,1249486,1249490,1249494,1249500,1249504,1249506,1249508,1249509,1249510,1249513,1249515,1249516,1249522,1249523,1249524,1249526,1249533,1249538,1249540,1249542,1249545,1249547,1249548,1249550,1249552,1249554,1249562,1249566,1249587,1249598,1249604,1249608,1249615,1249618,1249774,1249833,1249887,1249888,1249901,1249904,1249906,1249915,1249974,1249975,1250002,1250007,1250021,1250025,1250028,1250032,1250087,1250088,1250119,1250123,1250124,1250177,1250179,1250203,1250204,1250205,1250237,1250242,1250247,1250249,1250251,1250258,1250262,1250266,1250267,1250268,1250275,1250276,1250281,1250291,1250292,1250294,12502
96,1250297,1250298,1250334,1250344,1250365,1250371,1250377,1250386,1250389,1250398,1250402,1250406,1250407,1250408,1250450,1250491,1250519,1250522,1250650,1250655,1250671,1250702,1250711,1250712,1250713,1250716,1250719,1250722,1250729,1250736,1250737,1250739,1250741,1250742,1250758,1250952,1251100,1251114,1251134,1251135,1251143,1251146,1251186,1251216,1251230,1251810,1252084,CVE-2024-53164,CVE-2024-57891,CVE-2024-57951,CVE-2024-57952,CVE-2024-58090,CVE-2025-22034,CVE-2025-22077,CVE-2025-23141,CVE-2025-37798,CVE-2025-37821,CVE-2025-37849,CVE-2025-37856,CVE-2025-37861,CVE-2025-37864,CVE-2025-38006,CVE-2025-38008,CVE-2025-38019,CVE-2025-38034,CVE-2025-38038,CVE-2025-38052,CVE-2025-38058,CVE-2025-38062,CVE-2025-38075,CVE-2025-38087,CVE-2025-38088,CVE-2025-38089,CVE-2025-38090,CVE-2025-38091,CVE-2025-38095,CVE-2025-38096,CVE-2025-38098,CVE-2025-38099,CVE-2025-38101,CVE-2025-38102,CVE-2025-38103,CVE-2025-38106,CVE-2025-38107,CVE-2025-38108,CVE-2025-38109,CVE-2025-38110,CVE-2025-38111,CVE
-2025-38112,CVE-2025-38113,CVE-2025-38114,CVE-2025-38117,CVE-2025-38118,CVE-2025-38119,CVE-2025-38120,CVE-2025-38122,CVE-2025-38123,CVE-2025-38124,CVE-2025-38125,CVE-2025-38127,CVE-2025-38128,CVE-2025-38129,CVE-2025-38134,CVE-2025-38135,CVE-2025-38136,CVE-2025-38137,CVE-2025-38138,CVE-2025-38140,CVE-2025-38141,CVE-2025-38142,CVE-2025-38143,CVE-2025-38145,CVE-2025-38146,CVE-2025-38148,CVE-2025-38149,CVE-2025-38151,CVE-2025-38153,CVE-2025-38154,CVE-2025-38155,CVE-2025-38156,CVE-2025-38157,CVE-2025-38159,CVE-2025-38160,CVE-2025-38161,CVE-2025-38165,CVE-2025-38168,CVE-2025-38169,CVE-2025-38170,CVE-2025-38172,CVE-2025-38173,CVE-2025-38174,CVE-2025-38177,CVE-2025-38180,CVE-2025-38181,CVE-2025-38182,CVE-2025-38184,CVE-2025-38185,CVE-2025-38186,CVE-2025-38188,CVE-2025-38189,CVE-2025-38190,CVE-2025-38193,CVE-2025-38197,CVE-2025-38198,CVE-2025-38201,CVE-2025-38205,CVE-2025-38208,CVE-2025-38209,CVE-2025-38211,CVE-2025-38213,CVE-2025-38214,CVE-2025-38215,CVE-2025-38216,CVE-2025-38217,CVE-2025-3
8220,CVE-2025-38222,CVE-2025-38224,CVE-2025-38225,CVE-2025-38226,CVE-2025-38227,CVE-2025-38228,CVE-2025-38229,CVE-2025-38231,CVE-2025-38232,CVE-2025-38233,CVE-2025-38234,CVE-2025-38242,CVE-2025-38244,CVE-2025-38245,CVE-2025-38246,CVE-2025-38249,CVE-2025-38251,CVE-2025-38253,CVE-2025-38255,CVE-2025-38256,CVE-2025-38257,CVE-2025-38258,CVE-2025-38259,CVE-2025-38263,CVE-2025-38264,CVE-2025-38265,CVE-2025-38267,CVE-2025-38268,CVE-2025-38270,CVE-2025-38272,CVE-2025-38273,CVE-2025-38274,CVE-2025-38275,CVE-2025-38277,CVE-2025-38278,CVE-2025-38286,CVE-2025-38287,CVE-2025-38288,CVE-2025-38289,CVE-2025-38290,CVE-2025-38291,CVE-2025-38292,CVE-2025-38293,CVE-2025-38299,CVE-2025-38300,CVE-2025-38301,CVE-2025-38302,CVE-2025-38303,CVE-2025-38304,CVE-2025-38305,CVE-2025-38306,CVE-2025-38307,CVE-2025-38311,CVE-2025-38312,CVE-2025-38313,CVE-2025-38315,CVE-2025-38317,CVE-2025-38318,CVE-2025-38319,CVE-2025-38322,CVE-2025-38323,CVE-2025-38326,CVE-2025-38332,CVE-2025-38335,CVE-2025-38336,CVE-2025-38337,CV
E-2025-38338,CVE-2025-38339,CVE-2025-38341,CVE-2025-38342,CVE-2025-38343,CVE-2025-38344,CVE-2025-38345,CVE-2025-38348,CVE-2025-38349,CVE-2025-38350,CVE-2025-38351,CVE-2025-38352,CVE-2025-38353,CVE-2025-38354,CVE-2025-38355,CVE-2025-38356,CVE-2025-38359,CVE-2025-38360,CVE-2025-38361,CVE-2025-38362,CVE-2025-38363,CVE-2025-38364,CVE-2025-38365,CVE-2025-38368,CVE-2025-38369,CVE-2025-38371,CVE-2025-38372,CVE-2025-38373,CVE-2025-38374,CVE-2025-38375,CVE-2025-38376,CVE-2025-38377,CVE-2025-38380,CVE-2025-38381,CVE-2025-38382,CVE-2025-38383,CVE-2025-38384,CVE-2025-38385,CVE-2025-38386,CVE-2025-38387,CVE-2025-38389,CVE-2025-38390,CVE-2025-38391,CVE-2025-38392,CVE-2025-38393,CVE-2025-38395,CVE-2025-38396,CVE-2025-38397,CVE-2025-38399,CVE-2025-38400,CVE-2025-38401,CVE-2025-38402,CVE-2025-38403,CVE-2025-38404,CVE-2025-38405,CVE-2025-38406,CVE-2025-38408,CVE-2025-38409,CVE-2025-38410,CVE-2025-38412,CVE-2025-38413,CVE-2025-38414,CVE-2025-38415,CVE-2025-38416,CVE-2025-38417,CVE-2025-38418,CVE-2025-
38419,CVE-2025-38420,CVE-2025-38421,CVE-2025-38424,CVE-2025-38425,CVE-2025-38426,CVE-2025-38427,CVE-2025-38428,CVE-2025-38429,CVE-2025-38430,CVE-2025-38436,CVE-2025-38438,CVE-2025-38439,CVE-2025-38440,CVE-2025-38441,CVE-2025-38443,CVE-2025-38444,CVE-2025-38445,CVE-2025-38446,CVE-2025-38448,CVE-2025-38449,CVE-2025-38450,CVE-2025-38451,CVE-2025-38453,CVE-2025-38454,CVE-2025-38455,CVE-2025-38456,CVE-2025-38457,CVE-2025-38458,CVE-2025-38459,CVE-2025-38460,CVE-2025-38461,CVE-2025-38462,CVE-2025-38463,CVE-2025-38464,CVE-2025-38465,CVE-2025-38466,CVE-2025-38467,CVE-2025-38468,CVE-2025-38470,CVE-2025-38472,CVE-2025-38473,CVE-2025-38474,CVE-2025-38475,CVE-2025-38476,CVE-2025-38477,CVE-2025-38478,CVE-2025-38480,CVE-2025-38481,CVE-2025-38482,CVE-2025-38483,CVE-2025-38484,CVE-2025-38485,CVE-2025-38487,CVE-2025-38488,CVE-2025-38489,CVE-2025-38490,CVE-2025-38491,CVE-2025-38493,CVE-2025-38494,CVE-2025-38495,CVE-2025-38496,CVE-2025-38497,CVE-2025-38499,CVE-2025-38500,CVE-2025-38503,CVE-2025-38506,C
VE-2025-38508,CVE-2025-38514,CVE-2025-38524,CVE-2025-38526,CVE-2025-38527,CVE-2025-38528,CVE-2025-38531,CVE-2025-38533,CVE-2025-38539,CVE-2025-38544,CVE-2025-38545,CVE-2025-38546,CVE-2025-38549,CVE-2025-38552,CVE-2025-38553,CVE-2025-38554,CVE-2025-38555,CVE-2025-38556,CVE-2025-38557,CVE-2025-38559,CVE-2025-38560,CVE-2025-38563,CVE-2025-38564,CVE-2025-38565,CVE-2025-38566,CVE-2025-38568,CVE-2025-38571,CVE-2025-38572,CVE-2025-38573,CVE-2025-38574,CVE-2025-38576,CVE-2025-38581,CVE-2025-38582,CVE-2025-38583,CVE-2025-38584,CVE-2025-38585,CVE-2025-38586,CVE-2025-38587,CVE-2025-38588,CVE-2025-38591,CVE-2025-38593,CVE-2025-38595,CVE-2025-38597,CVE-2025-38601,CVE-2025-38602,CVE-2025-38604,CVE-2025-38605,CVE-2025-38608,CVE-2025-38609,CVE-2025-38610,CVE-2025-38612,CVE-2025-38614,CVE-2025-38616,CVE-2025-38617,CVE-2025-38618,CVE-2025-38619,CVE-2025-38621,CVE-2025-38622,CVE-2025-38623,CVE-2025-38624,CVE-2025-38628,CVE-2025-38630,CVE-2025-38631,CVE-2025-38632,CVE-2025-38634,CVE-2025-38635,CVE-2025
-38639,CVE-2025-38640,CVE-2025-38643,CVE-2025-38644,CVE-2025-38646,CVE-2025-38648,CVE-2025-38656,CVE-2025-38658,CVE-2025-38659,CVE-2025-38660,CVE-2025-38662,CVE-2025-38664,CVE-2025-38665,CVE-2025-38668,CVE-2025-38670,CVE-2025-38671,CVE-2025-38676,CVE-2025-38678,CVE-2025-38679,CVE-2025-38680,CVE-2025-38681,CVE-2025-38683,CVE-2025-38684,CVE-2025-38685,CVE-2025-38686,CVE-2025-38687,CVE-2025-38691,CVE-2025-38692,CVE-2025-38693,CVE-2025-38694,CVE-2025-38695,CVE-2025-38700,CVE-2025-38701,CVE-2025-38702,CVE-2025-38703,CVE-2025-38705,CVE-2025-38706,CVE-2025-38709,CVE-2025-38710,CVE-2025-38717,CVE-2025-38721,CVE-2025-38722,CVE-2025-38724,CVE-2025-38725,CVE-2025-38727,CVE-2025-38729,CVE-2025-38730,CVE-2025-38732,CVE-2025-38733,CVE-2025-38734,CVE-2025-38735,CVE-2025-38736,CVE-2025-39673,CVE-2025-39675,CVE-2025-39677,CVE-2025-39678,CVE-2025-39679,CVE-2025-39681,CVE-2025-39682,CVE-2025-39683,CVE-2025-39684,CVE-2025-39685,CVE-2025-39686,CVE-2025-39687,CVE-2025-39691,CVE-2025-39693,CVE-2025-39694,
CVE-2025-39695,CVE-2025-39697,CVE-2025-39698,CVE-2025-39700,CVE-2025-39701,CVE-2025-39703,CVE-2025-39705,CVE-2025-39706,CVE-2025-39707,CVE-2025-39709,CVE-2025-39710,CVE-2025-39711,CVE-2025-39712,CVE-2025-39713,CVE-2025-39714,CVE-2025-39718,CVE-2025-39719,CVE-2025-39721,CVE-2025-39722,CVE-2025-39723,CVE-2025-39724,CVE-2025-39726,CVE-2025-39727,CVE-2025-39730,CVE-2025-39732,CVE-2025-39738,CVE-2025-39739,CVE-2025-39742,CVE-2025-39744,CVE-2025-39746,CVE-2025-39747,CVE-2025-39748,CVE-2025-39749,CVE-2025-39750,CVE-2025-39751,CVE-2025-39754,CVE-2025-39757,CVE-2025-39758,CVE-2025-39759,CVE-2025-39760,CVE-2025-39761,CVE-2025-39763,CVE-2025-39764,CVE-2025-39765,CVE-2025-39766,CVE-2025-39770,CVE-2025-39772,CVE-2025-39773,CVE-2025-39775,CVE-2025-39782,CVE-2025-39783,CVE-2025-39787,CVE-2025-39788,CVE-2025-39790,CVE-2025-39791,CVE-2025-39792,CVE-2025-39797,CVE-2025-39798,CVE-2025-39800,CVE-2025-39801,CVE-2025-39806,CVE-2025-39807,CVE-2025-39808,CVE-2025-39810,CVE-2025-39811,CVE-2025-39813,CVE-202
5-39816,CVE-2025-39823,CVE-2025-39824,CVE-2025-39825,CVE-2025-39826,CVE-2025-39827,CVE-2025-39828,CVE-2025-39830,CVE-2025-39832,CVE-2025-39833,CVE-2025-39834,CVE-2025-39835,CVE-2025-39836,CVE-2025-39838,CVE-2025-39839,CVE-2025-39841,CVE-2025-39842,CVE-2025-39844,CVE-2025-39845,CVE-2025-39847,CVE-2025-39848,CVE-2025-39849,CVE-2025-39850,CVE-2025-39851,CVE-2025-39852,CVE-2025-39853,CVE-2025-39854,CVE-2025-39857,CVE-2025-39860,CVE-2025-39861,CVE-2025-39863,CVE-2025-39864,CVE-2025-39865,CVE-2025-39869,CVE-2025-39870,CVE-2025-39871,CVE-2025-39873,CVE-2025-39875,CVE-2025-39877,CVE-2025-39882,CVE-2025-39884,CVE-2025-39885,CVE-2025-39889,CVE-2025-39890,CVE-2025-39891,CVE-2025-39896,CVE-2025-39898,CVE-2025-39899,CVE-2025-39900,CVE-2025-39902,CVE-2025-39907,CVE-2025-39909,CVE-2025-39916,CVE-2025-39918,CVE-2025-39922,CVE-2025-39923,CVE-2025-39925,CVE-2025-39926,CVE-2025-39931,CVE-2025-39934,CVE-2025-39937,CVE-2025-39938,CVE-2025-39945,CVE-2025-39946,CVE-2025-39952,CVE-2025-39957,CVE-2025-40300
The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
- CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
- CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
- CVE-2024-57952: Revert 'libfs: fix infinite directory reads for offset dir' (bsc#1237131).
- CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
- CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
- CVE-2025-22077: Revert 'smb: client: fix TCP timers deadlock after rmmod' (bsc#1241403).
- CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
- CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
- CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
- CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
- CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
- CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
- CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
- CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
- CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
- CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
- CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
- CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
- CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
- CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
- CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
- CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
- CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
- CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
- CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
- CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
- CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
- CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
- CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
- CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
- CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
- CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
- CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
- CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
- CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
- CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
- CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
- CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
- CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
- CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap cache (bsc#1246176).
- CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
- CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
- CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
- CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).
- CVE-2025-38258: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write (bsc#1246185).
- CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
- CVE-2025-38267: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (bsc#1246245).
- CVE-2025-38270: net: drv: netdevsim: do not napi_complete() from netpoll (bsc#1246252).
- CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).
- CVE-2025-38301: nvmem: zynqmp_nvmem: unbreak driver after cleanup (bsc#1246351).
- CVE-2025-38306: fs/fhandle.c: fix a race in call of has_locked_children() (bsc#1246366).
- CVE-2025-38311: iavf: get rid of the crit lock (bsc#1246376).
- CVE-2025-38318: perf: arm-ni: Fix missing platform_set_drvdata() (bsc#1246444).
- CVE-2025-38322: perf/x86/intel: Fix crash in icl_update_topdown_event() (bsc#1246447).
- CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
- CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).
- CVE-2025-38341: eth: fbnic: avoid double free when failing to DMA-map FW msg (bsc#1246260).
- CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).
- CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
- CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
- CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
- CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
- CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
- CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).
- CVE-2025-38374: optee: ffa: fix sleep in atomic context (bsc#1247024).
- CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).
- CVE-2025-38383: mm/vmalloc: fix data race in show_numa_info() (bsc#1247250).
- CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
- CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).
- CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).
- CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
- CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
- CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
- CVE-2025-38419: remoteproc: core: Cleanup acquired resources when
rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
- CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
- CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
- CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
- CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
- CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
- CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
- CVE-2025-38451: md/md-bitmap: fix GPF in bitmap_get_stats() (bsc#1247102).
- CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).
- CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
- CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
- CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
- CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
- CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
- CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).
- CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
- CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
- CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
- CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).
- CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
- CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
- CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
- CVE-2025-38493: tracing/osnoise: Fix crash in timerlat_dump_stack() (bsc#1247283).
- CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).
- CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
- CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
- CVE-2025-38508: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation (bsc#1248190).
- CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
- CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
- CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
- CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
- CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
- CVE-2025-38539: tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211).
- CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
- CVE-2025-38545: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (bsc#1248224).
- CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
- CVE-2025-38554: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped (bsc#1248299).
- CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
- CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
- CVE-2025-38566: sunrpc: fix handling of server side tls alerts (bsc#1248374).
- CVE-2025-38571: sunrpc: fix client side handling of tls alerts (bsc#1248401).
- CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
- CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
- CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
- CVE-2025-38588: ipv6: prevent infinite loop in rt6_nlmsg_size() (bsc#1248368).
- CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
- CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
- CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
- CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
- CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
- CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
- CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
- CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
- CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
- CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
- CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
- CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
- CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248748).
- CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
- CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
- CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
- CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
- CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
- CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
- CVE-2025-38686: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (bsc#1249160).
- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
- CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
- CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
- CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
- CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
- CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
- CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
- CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
- CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
- CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
- CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
- CVE-2025-39698: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (bsc#1249322).
- CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
- CVE-2025-39723: kABI: netfs: handle new netfs_io_stream flag (bsc#1249314).
- CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
- CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
- CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
- CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
- CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
- CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
- CVE-2025-39775: mm/mremap: fix WARN with uffd that has remap events disabled (bsc#1249500).
- CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
- CVE-2025-39791: dm: dm-crypt: Do not partially accept write BIOs with zoned targets (bsc#1249550).
- CVE-2025-39792: dm: Always split write BIOs to zoned device limits (bsc#1249618).
- CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
- CVE-2025-39813: ftrace: Also allocate and copy hash for reading of filter files (bsc#1250032).
- CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths (bsc#1249906).
- CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
- CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
- CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
- CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
- CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
- CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
- CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
- CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
- CVE-2025-39852: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (bsc#1250258).
- CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
- CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
- CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
- CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
- CVE-2025-39875: igb: Fix NULL pointer dereference in ethtool loopback test (bsc#1250398).
- CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
- CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
- CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
- CVE-2025-39926: genetlink: fix genl_bind() invoking bind() after -EPERM (bsc#1250737).
- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
- CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).
- CVE-2026-38264: nvme-tcp: sanitize request list handling (bsc#1246387).
The following non-security bugs were fixed:
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
- ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).
- ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes).
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (stable-fixes).
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (stable-fixes).
- ACPI: LPSS: Remove AudioDSP related ID (git-fixes).
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (git-fixes).
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (git-fixes).
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (stable-fixes).
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (stable-fixes).
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (git-fixes).
- ACPI: battery: Add synchronization between interface updates (git-fixes).
- ACPI: debug: fix signedness issues in read/write helpers (git-fixes).
- ACPI: pfr_update: Fix the driver update version check (git-fixes).
- ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
- ACPI: processor: fix acpi_object initialization (stable-fixes).
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (git-fixes).
- ACPI: processor: perflib: Fix initial _PPC limit application (git-fixes).
- ACPI: processor: perflib: Move problematic pr->performance check (git-fixes).
- ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
- ACPICA: Fix largest possible resource descriptor index (git-fixes).
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (stable-fixes).
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (stable-fixes).
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (git-fixes).
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (stable-fixes).
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (stable-fixes).
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (stable-fixes).
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (stable-fixes).
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (stable-fixes).
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (stable-fixes).
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (stable-fixes).
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (stable-fixes).
- ALSA: hda/realtek: Add ALC295 Dell TAS2781 I2C fixup (git-fixes).
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (stable-fixes).
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (stable-fixes).
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (stable-fixes).
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (git-fixes).
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (stable-fixes).
- ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 (git-fixes).
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (stable-fixes).
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (git-fixes).
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (stable-fixes).
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (stable-fixes).
- ALSA: hda: Disable jack polling at shutdown (stable-fixes).
- ALSA: hda: Handle the jack polling always via a work (stable-fixes).
- ALSA: hda: intel-dsp-config: Prevent SEGFAULT if ACPI_HANDLE() is NULL (git-fixes).
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (stable-fixes).
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (git-fixes).
- ALSA: lx_core: use int type to store negative error codes (git-fixes).
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (git-fixes).
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (stable-fixes).
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (git-fixes).
- ALSA: timer: fix ida_free call while not allocated (git-fixes).
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (stable-fixes).
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (stable-fixes).
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (stable-fixes).
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (stable-fixes).
- ALSA: usb-audio: Allow Focusrite devices to use low samplerates (git-fixes).
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (stable-fixes).
- ALSA: usb-audio: Convert comma to semicolon (git-fixes).
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Fix block comments in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (git-fixes).
- ALSA: usb-audio: Fix code alignment in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (git-fixes).
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (stable-fixes).
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (git-fixes).
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (git-fixes).
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (git-fixes).
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (git-fixes).
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (stable-fixes).
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (stable-fixes).
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (git-fixes).
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (git-fixes).
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (git-fixes).
- ASoC: Intel: catpt: Expose correct bit depth to userspace (git-fixes).
- ASoC: Intel: fix SND_SOC_SOF dependencies (stable-fixes).
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (git-fixes).
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (git-fixes).
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (git-fixes).
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (git-fixes).
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (git-fixes).
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (git-fixes).
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (git-fixes).
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (git-fixes).
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (stable-fixes).
- ASoC: amd: acp: Adjust pdm gain value (stable-fixes).
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx (stable-fixes).
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (stable-fixes).
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (stable-fixes).
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (stable-fixes).
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (git-fixes).
- ASoC: codecs: wcd937x: Drop unused buck_supply (git-fixes).
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (stable-fixes).
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (git-fixes).
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (git-fixes).
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (stable-fixes).
- ASoC: imx-hdmi: remove cpu_pdev related code (git-fixes).
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (git-fixes).
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (git-fixes).
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (git-fixes).
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (git-fixes).
- ASoC: qcom: audioreach: fix potential null pointer dereference (git-fixes).
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (git-fixes).
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (git-fixes).
- ASoC: qcom: use drvdata instead of component to keep id (stable-fixes).
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (stable-fixes).
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (git-fixes).
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (stable-fixes).
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (git-fixes).
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (git-fixes).
- ASoC: wm8940: Correct PLL rate rounding (git-fixes).
- ASoC: wm8940: Correct typo in control name (git-fixes).
- ASoC: wm8974: Correct PLL rate rounding (git-fixes).
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (git-fixes).
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (git-fixes).
- Bluetooth: ISO: do not leak skb in ISO_CONT RX (git-fixes).
- Bluetooth: ISO: free rx_skb if not consumed (git-fixes).
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (git-fixes).
- Bluetooth: MGMT: Fix possible UAFs (git-fixes).
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (git-fixes).
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes).
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (stable-fixes).
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (stable-fixes).
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (git-fixes).
- Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings (git-fixes).
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (git-fixes).
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (git-fixes).
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (git-fixes).
- Bluetooth: hci_event: Mask data status from LE ext adv reports (git-fixes).
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (git-fixes).
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (git-fixes).
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (stable-fixes).
- Bluetooth: hci_sync: Avoid adding default advertising on startup (stable-fixes).
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (git-fixes).
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (git-fixes).
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (git-fixes).
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (git-fixes).
- Bluetooth: hci_sync: fix set_local_name race condition (git-fixes).
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (git-fixes).
- CONFIG & no reference -> OK temporarily, must be resolved eventually
- Disable CET before shutdown by tboot (bsc#1247950).
- Docs/ABI: Fix sysfs-kernel-address_bits path (git-fixes).
- Documentation/x86: Document new attack vector controls (git-fixes).
- Documentation: ACPI: Fix parent device references (git-fixes).
- Documentation: KVM: Fix unexpected unindent warning (git-fixes).
- Documentation: KVM: Fix unexpected unindent warnings (git-fixes).
- Documentation: usb: gadget: Wrap remaining usage snippets in literal code block (git-fixes).
- Drop ath12k patch that was reverted in the upstream (git-fixes)
- EDAC/{i10nm,skx,skx_common}: Support UV systems (bsc#1234693).
- Enable CONFIG_CMA_SYSFS This is a generally useful feature for anyone
using CMA or investigating CMA issues, with a small and simple code base
and no runtime overhead.
- Enable MT7925 WiFi drivers for openSUSE Leap 16.0 (bsc#1247325)
- Enable SMC_LO (a.k.a SMC-D) (jsc#PED-13256).
- Fix bogus i915 patch backport (bsc#1238972) It's been already cherry-picked in 6.12 kernel itself.
- Fix dma_unmap_sg() nents value (git-fixes)
- HID: amd_sfh: Add sync across amd sfh work functions (git-fixes).
- HID: apple: avoid setting up battery timer for devices without battery (git-fixes).
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (git-fixes).
- HID: asus: add support for missing PX series fn keys (stable-fixes).
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (git-fixes).
- HID: core: do not bypass hid_hw_raw_request (stable-fixes).
- HID: core: ensure the allocated report buffer can contain the reserved report ID (stable-fixes).
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (stable-fixes).
- HID: hidraw: tighten ioctl command parsing (git-fixes).
- HID: input: rename hidinput_set_battery_charge_status() (stable-fixes).
- HID: input: report battery status changes immediately (git-fixes).
- HID: intel-ish-ipc: Remove redundant ready check after timeout function (git-fixes).
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (stable-fixes).
- HID: magicmouse: avoid setting up battery timer when not needed (git-fixes).
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (git-fixes).
- HID: quirks: add support for Legion Go dual dinput modes (stable-fixes).
- HID: wacom: Add a new Art Pen 2 (stable-fixes).
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (git-fixes)
- IB/sa: Fix sa_local_svc_timeout_ms read race (git-fixes)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (stable-fixes).
- Input: iqs7222 - avoid enabling unused interrupts (stable-fixes).
- Input: psxpad-spi - add a check for the return value of spi_setup() (git-fixes).
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (git-fixes).
- KEYS: X.509: Fix Basic Constraints CA flag parsing (git-fixes).
- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).
- KVM: Allow CPU to reschedule while setting per-page memory attributes (git-fixes).
- KVM: Bail from the dirty ring reset flow if a signal is pending (git-fixes).
- KVM: Bound the number of dirty ring entries in a single reset at INT_MAX (git-fixes).
- KVM: Conditionally reschedule when resetting the dirty ring (git-fixes).
- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).
- KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest (git-fixes).
- KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (git-fixes).
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (jsc#PED-13302).
- KVM: TDX: Do not report base TDVMCALLs (git-fixes).
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (jsc#PED-13302).
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (jsc#PED-13302).
- KVM: TDX: Handle TDG.VP.VMCALL<GetQuote> (jsc#PED-13302).
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (jsc#PED-13302).
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (git-fixes).
- KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).
- KVM: VMX: Ensure unused kvm_tdx_capabilities fields are zeroed out (jsc#PED-13302).
- KVM: arm64: Adjust range correctly during host stage-2 faults (git-fixes).
- KVM: arm64: Do not free hyp pages with pKVM on GICv2 (git-fixes).
- KVM: arm64: Fix error path in init_hyp_mode() (git-fixes).
- KVM: arm64: Mark freed S2 MMUs as invalid (git-fixes).
- KVM: arm64: vgic: fix incorrect spinlock API usage (git-fixes).
- KVM: s390: Fix access to unavailable adapter indicator pages during postcopy (git-fixes bsc#1250124).
- KVM: s390: Fix incorrect usage of mmu_notifier_register() (git-fixes bsc#1250123).
- KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes).
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table (git-fixes).
- KVM: x86: Avoid calling kvm_is_mmio_pfn() when kvm_x86_ops.get_mt_mask is NULL (git-fixes).
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).
- KVM: x86: Drop pending_smi vs. INIT_RECEIVED check when setting MP_STATE (git-fixes).
- KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC protected guest (git-fixes).
- KVM: x86: avoid underflow when scaling TSC frequency (git-fixes).
- Limit patch filenames to 100 characters (bsc#1249604).
- Move upstreamed SPI patch into sorted section
- NFS: Fix a race when updating an existing write (git-fixes).
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (git-fixes).
- NFS: Fix the setting of capabilities when automounting a new filesystem (git-fixes).
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (git-fixes).
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (git-fixes).
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (git-fixes).
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes).
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (git-fixes).
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (git-fixes).
- NFSv4.1: fix backchannel max_resp_sz verification check (git-fixes).
- NFSv4.2: another fix for listxattr (git-fixes).
- NFSv4/flexfiles: Fix layout merge mirror check (git-fixes).
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (git-fixes).
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (git-fixes).
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (git-fixes).
- NFSv4: Do not clear capabilities that won't be reset (git-fixes).
- Octeontx2-af: Skip overlap check for SPI field (git-fixes).
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (git-fixes).
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (git-fixes).
- PCI/AER: Fix missing uevent on recovery when a reset is requested (git-fixes).
- PCI/ERR: Fix uevent on failure to recover (git-fixes).
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (git-fixes).
- PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations (bsc#1245457).
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (git-fixes).
- PCI/pwrctrl: Fix device leak at registration (git-fixes).
- PCI/sysfs: Ensure devices are powered for config reads (git-fixes).
- PCI: Extend isolated function probing to LoongArch (git-fixes).
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (git-fixes).
- PCI: Support Immediate Readiness on devices without PM capabilities (git-fixes).
- PCI: dw-rockchip: Replace PERST# sleep time with proper macro (git-fixes).
- PCI: dw-rockchip: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ (git-fixes).
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (stable-fixes).
- PCI: endpoint: Fix configfs group list head handling (git-fixes).
- PCI: endpoint: Fix configfs group removal on driver teardown (git-fixes).
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (git-fixes).
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (git-fixes).
- PCI: hv: Allow dynamic MSI-X vector allocation (bsc#1245457).
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (git-fixes).
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (git-fixes).
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (git-fixes).
- PCI: imx6: Delay link start until configfs 'start' written (git-fixes).
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (git-fixes).
- PCI: j721e: Fix incorrect error message in probe() (git-fixes).
- PCI: j721e: Fix programming sequence of 'strap' settings (git-fixes).
- PCI: keystone: Use devm_request_irq() to free 'ks-pcie-error-irq' on exit (git-fixes).
- PCI: pnv_php: Clean up allocated IRQs on unplug (bsc#1215199).
- PCI: pnv_php: Work around switches with broken presence detection (bsc#1215199).
- PCI: qcom: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ (git-fixes).
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (git-fixes).
- PCI: rcar-gen4: Assure reset occurs before DBI access (git-fixes).
- PCI: rcar-gen4: Fix PHY initialization (git-fixes).
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (git-fixes).
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes).
- PCI: rcar-host: Drop PMSR spinlock (git-fixes).
- PCI: rockchip-host: Fix 'Unexpected Completion' log message (git-fixes).
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (git-fixes).
- PCI: rockchip: Use standard PCIe definitions (git-fixes).
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (git-fixes).
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (git-fixes).
- PCI: tegra194: Handle errors in BPMP response (git-fixes).
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes).
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (git-fixes).
- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (git-fixes).
- PCI: xilinx-nwl: Fix ECAM programming (git-fixes).
- PM / devfreq: Check governor before using governor->name (git-fixes).
- PM / devfreq: Fix a index typo in trans_stat (git-fixes).
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (stable-fixes).
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (git-fixes).
- PM / devfreq: rockchip-dfi: double count on RK3588 (git-fixes).
- PM: EM: use kfree_rcu() to simplify the code (stable-fixes).
- PM: cpufreq: powernv/tracing: Move powernv_throttle trace event (git-fixes).
- PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).
- PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).
- PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).
- PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (stable-fixes).
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (git-fixes).
- PM: sleep: console: Fix the black screen issue (stable-fixes).
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (git-fixes).
- RAS/AMD/ATL: Include row bit in row retirement (bsc#1242034).
- RAS/AMD/FMPM: Get masked address (bsc#1242034).
- RDMA/bnxt_re: Fix a possible memory leak in the driver (git-fixes)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (git-fixes)
- RDMA/bnxt_re: Fix to do SRQ armena by default (git-fixes)
- RDMA/bnxt_re: Fix to initialize the PBL array (git-fixes)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (git-fixes)
- RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes)
- RDMA/core: Rate limit GID cache warning messages (git-fixes)
- RDMA/core: Resolve MAC of next-hop device without ARP support (git-fixes)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (git-fixes)
- RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (git-fixes)
- RDMA/hns: Drop GFP_NOWARN (git-fixes)
- RDMA/hns: Fix -Wframe-larger-than issue (git-fixes)
- RDMA/hns: Fix HW configurations not cleared in error flow (git-fixes)
- RDMA/hns: Fix accessing uninitialized resources (git-fixes)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (git-fixes)
- RDMA/hns: Fix double destruction of rsv_qp (git-fixes)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (git-fixes)
- RDMA/hns: Get message length of ack_req from FW (git-fixes)
- RDMA/mana_ib: Add device statistics support (bsc#1246651).
- RDMA/mana_ib: Drain send wrs of GSI QP (bsc#1251135).
- RDMA/mana_ib: Extend modify QP (bsc#1251135).
- RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes).
- RDMA/mana_ib: add additional port counters (git-fixes).
- RDMA/mana_ib: add support of multiple ports (git-fixes).
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (git-fixes)
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes)
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes)
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes)
- RDMA/mlx5: Fix UMR modifying of mkey page size (git-fixes)
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes)
- RDMA/mlx5: Fix vport loopback forcing for MPV device (git-fixes)
- RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes)
- RDMA/rxe: Fix race in do_task() when draining (git-fixes)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (git-fixes)
- RDMA/siw: Always report immediate post SQ errors (git-fixes)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (git-fixes)
- RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes)
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes)
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes)
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (git-fixes)
- README.BRANCH: mfranc at suse.cz leaving SUSE
- RISC-V: Add defines for the SBI nested acceleration extension (jsc#PED-348).
- Reapply 'wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()' (git-fixes).
- Reapply 'x86/smp: Eliminate mwait_play_dead_cpuid_hint()' (jsc#PED-13815).
- Revert 'SUNRPC: Do not allow waiting for exiting tasks' (git-fixes).
- Revert 'drm/amdgpu: fix incorrect vm flags to map bo' (stable-fixes).
- Revert 'drm/nouveau: check ioctl command codes better' (git-fixes).
- Revert 'gpio: mlxbf3: only get IRQ for device instance 0' (git-fixes).
- Revert 'leds: trigger: netdev: Configure LED blink interval for HW offload' (git-fixes).
- Revert 'mac80211: Dynamically set CoDel parameters per station' (stable-fixes).
- Revert 'usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running' (git-fixes).
- Revert 'vgacon: Add check for vc_origin address range in vgacon_scroll()' (stable-fixes).
- Revert 'wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO' (git-fixes).
- SUNRPC: call xs_sock_process_cmsg for all cmsg (git-fixes).
- Squashfs: add additional inode sanity checking (git-fixes).
- Squashfs: fix uninit-value in squashfs_get_parent (git-fixes).
- Squashfs: reject negative file sizes in squashfs_read_inode() (git-fixes).
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (git-fixes).
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (git-fixes).
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (stable-fixes).
- USB: serial: option: add Foxconn T99W640 (stable-fixes).
- USB: serial: option: add Foxconn T99W709 (stable-fixes).
- USB: serial: option: add SIMCom 8230C compositions (stable-fixes).
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (stable-fixes).
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (stable-fixes).
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (stable-fixes).
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (stable-fixes).
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (stable-fixes).
- Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
- Update config files: revive pwc driver for Leap (bsc#1249060)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (git-fixes).
- accel/ivpu: Correct DCT interrupt handling (git-fixes).
- accel/ivpu: Fix reset_engine debugfs file logic (stable-fixes).
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (git-fixes).
- accel/ivpu: Prevent recovery work from being queued during device removal (git-fixes).
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (stable-fixes).
- aoe: defer rexmit timer downdev work to workqueue (git-fixes).
- arch/powerpc: Remove .interp section in vmlinux (bsc#1215199).
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (git-fixes)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (git-fixes)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (git-fixes)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (git-fixes)
- arm64/mm: Drop wrong writes into TCR2_EL1 (git-fixes)
- arm64/mm: Ensure adequate HUGE_MAX_HSTATE (git-fixes)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (git-fixes)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (git-fixes)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (git-fixes)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (git-fixes)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (git-fixes)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (git-fixes)
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (git-fixes)
- arm64: Handle KCOV __init vs inline mismatches (git-fixes)
- arm64: Mark kernel as tainted on SAE and SError panic (git-fixes)
- arm64: Restrict pagetable teardown to avoid false warning (git-fixes)
- arm64: config: Make tpm_tis_spi module build-in (bsc#1246896)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (git-fixes)
- arm64: dts: add big-endian property back into watchdog node (git-fixes)
- arm64: dts: apple: Add ethernet0 alias for J375 template (git-fixes)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (git-fixes)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (git-fixes)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (git-fixes)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (git-fixes)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (git-fixes)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (git-fixes)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (git-fixes)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI (git-fixes)
- arm64: dts: imx8mm-venice-gw700x: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mm-venice-gw7901: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mm-venice-gw7902: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mm-venice-gw7903: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mm-venice-gw7904: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (git-fixes)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI (git-fixes)
- arm64: dts: imx8mn-venice-gw7902: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (git-fixes)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (git-fixes)
- arm64: dts: imx8mp-venice-gw702x: Increase HS400 USDHC clock speed (git-fixes)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (git-fixes)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (git-fixes)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (git-fixes)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (git-fixes)
- arm64: dts: imx8mp: Correct thermal sensor index (git-fixes)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics (git-fixes)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul (git-fixes)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (git-fixes)
- arm64: dts: imx93-kontron: Fix USB port assignment (git-fixes)
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (git-fixes)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (git-fixes)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (git-fixes)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 (git-fixes)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (git-fixes).
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (git-fixes)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on (git-fixes)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (git-fixes)
- arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 (git-fixes)
- arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 (git-fixes)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (git-fixes)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (git-fixes)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on (git-fixes)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma (git-fixes)
- arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP (git-fixes)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (git-fixes)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (git-fixes)
- arm64: dts: st: fix timer used for ticks (git-fixes)
- arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module (git-fixes)
- arm64: map [_text, _stext) virtual address range (git-fixes)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (git-fixes)
- arm64: poe: Handle spurious Overlay faults (git-fixes)
- arm64: rust: clean Rust 1.85.0 warning using softfloat target (git-fixes)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (git-fixes)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (git-fixes)
- arm64: tegra: Drop remaining serial clock-names and reset-names (git-fixes)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (git-fixes)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (git-fixes)
- arm64: zynqmp: add clock-output-names property in clock nodes (git-fixes)
- ata: ahci: Disable DIPM if host lacks support (stable-fixes).
- ata: ahci: Disallow LPM policy control if not supported (stable-fixes).
- ata: libata-sata: Add link_power_management_supported sysfs attribute (git-fixes).
- ata: libata-sata: Disallow changing LPM state if not supported (stable-fixes).
- ata: libata-scsi: Fix CDL control (git-fixes).
- audit,module: restore audit logging in load failure case (git-fixes).
- ax25: properly unshare skbs in ax25_kiss_rcv() (git-fixes).
- batman-adv: fix OOB read/write in network-coding decode (git-fixes).
- benet: fix BUG when creating VFs (git-fixes).
- block: Introduce bio_needs_zone_write_plugging() (git-fixes).
- block: Make REQ_OP_ZONE_FINISH a write operation (git-fixes, bsc#1249552).
- block: ensure discard_granularity is zero when discard is not supported (git-fixes).
- block: fix kobject leak in blk_unregister_queue (git-fixes).
- block: mtip32xx: Fix usage of dma_map_sg() (git-fixes).
- block: sanitize chunk_sectors for atomic write limits (git-fixes).
- bnxt_en: Add a helper function to configure MRU and RSS (git-fixes).
- bnxt_en: Adjust TX rings if reservation is less than requested (git-fixes).
- bnxt_en: Fix DCB ETS validation (git-fixes).
- bnxt_en: Fix memory corruption when FW resources change during ifdown (git-fixes).
- bnxt_en: Fix stats context reservation logic (git-fixes).
- bnxt_en: Flush FW trace before copying to the coredump (git-fixes).
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (git-fixes).
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (git-fixes).
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (git-fixes)
- bpf, arm64: Fix fp initialization for exception boundary (git-fixes)
- bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c (git-fixes).
- bpf, sockmap: Fix psock incorrectly pointing to sk (git-fixes).
- bpf: Adjust free target to avoid global starvation of LRU map (git-fixes).
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (git-fixes).
- bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes).
- bpf: Check link_create.flags parameter for multi_kprobe (git-fixes).
- bpf: Check link_create.flags parameter for multi_uprobe (git-fixes).
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes).
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (git-fixes).
- bpf: Forget ranges when refining tnum after JSET (git-fixes).
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (git-fixes).
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (git-fixes).
- bpf: Reject %p% format string in bprintf-like helpers (git-fixes).
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (git-fixes).
- bpf: Reject narrower access to pointer ctx fields (git-fixes).
- bpf: Return prog btf_id without capable check (git-fixes).
- bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes).
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (git-fixes).
- bpf: fix possible endless loop in BPF map iteration (git-fixes).
- btrfs: abort transaction during log replay if walk_log_tree() failed (git-fixes).
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (git-fixes).
- btrfs: add assertions and comment about path expectations to btrfs_cross_ref_exist() (git-fixes).
- btrfs: add debug build only WARN (bsc#1249038).
- btrfs: add function comment for check_committed_ref() (git-fixes).
- btrfs: always abort transaction on failure to add block group to free space tree (git-fixes).
- btrfs: avoid load/store tearing races when checking if an inode was logged (git-fixes).
- btrfs: avoid redundant call to get inline ref type at check_committed_ref() (git-fixes).
- btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop (git-fixes).
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (git-fixes).
- btrfs: codify pattern for adding block_group to bg_list (git-fixes).
- btrfs: convert ASSERT(0) with handled errors to DEBUG_WARN() (bsc#1249038).
- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling (git-fixes).
- btrfs: correctly escape subvol in btrfs_show_options() (git-fixes).
- btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
- btrfs: do not ignore inode missing when replaying log tree (git-fixes).
- btrfs: do not output error message if a qgroup has been already cleaned up (git-fixes).
- btrfs: do not return VM_FAULT_SIGBUS on failure to set delalloc for mmap write (bsc#1247949).
- btrfs: do not silently ignore unexpected extent type when replaying log (git-fixes).
- btrfs: do not skip remaining extrefs if dir not found during log replay (git-fixes).
- btrfs: enhance ASSERT() to take optional format string (bsc#1249038).
- btrfs: error on missing block group when unaccounting log tree extent buffers (git-fixes).
- btrfs: exit after state split error at set_extent_bit() (git-fixes).
- btrfs: explicitly ref count block_group on new_bgs list (bsc#1243068)
- btrfs: fix -ENOSPC mmap write failure on NOCOW files/extents (bsc#1247949).
- btrfs: fix assertion when building free space tree (git-fixes).
- btrfs: fix corruption reading compressed range when block size is smaller than page size (git-fixes).
- btrfs: fix data overwriting bug during buffered write when block size < page size (git-fixes).
- btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents() (git-fixes).
- btrfs: fix incorrect log message for nobarrier mount option (git-fixes).
- btrfs: fix inode lookup error handling during log replay (git-fixes).
- btrfs: fix invalid extref key setup when replaying dentry (git-fixes).
- btrfs: fix invalid inode pointer after failure to create reloc inode (git-fixes).
- btrfs: fix invalid inode pointer dereferences during log replay (git-fixes).
- btrfs: fix iteration bug in __qgroup_excl_accounting() (git-fixes).
- btrfs: fix log tree replay failure due to file with 0 links and extents (git-fixes).
- btrfs: fix missing error handling when searching for inode refs during log replay (git-fixes).
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (git-fixes).
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (git-fixes).
- btrfs: fix race between logging inode and checking if it was logged before (git-fixes).
- btrfs: fix race between setting last_dir_index_offset and inode logging (git-fixes).
- btrfs: fix squota compressed stats leak (git-fixes).
- btrfs: fix ssd_spread overallocation (git-fixes).
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (git-fixes).
- btrfs: fix the inode leak in btrfs_iget() (git-fixes).
- btrfs: fix two misuses of folio_shift() (git-fixes).
- btrfs: fix wrong length parameter for btrfs_cleanup_ordered_extents() (git-fixes).
- btrfs: handle unaligned EOF truncation correctly for subpage cases (bsc#1249038).
- btrfs: initialize inode::file_extent_tree after i_mode has been set (git-fixes).
- btrfs: make btrfs_discard_workfn() block_group ref explicit (bsc#1243068)
- btrfs: make btrfs_iget() return a btrfs inode instead (git-fixes).
- btrfs: make btrfs_iget_path() return a btrfs inode instead (git-fixes).
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (git-fixes).
- btrfs: pass a btrfs_inode to fixup_inode_link_count() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_defrag_file() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_double_mmap_lock() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_double_mmap_unlock() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_extent_same_range() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_fill_inode() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_iget_locked() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_inode_inherit_props() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_inode_type() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_load_inode_props() (git-fixes).
- btrfs: pass struct btrfs_inode to btrfs_read_locked_inode() (git-fixes).
- btrfs: pass struct btrfs_inode to can_nocow_extent() (git-fixes).
- btrfs: pass struct btrfs_inode to clone_copy_inline_extent() (git-fixes).
- btrfs: pass struct btrfs_inode to extent_range_clear_dirty_for_io() (git-fixes).
- btrfs: pass struct btrfs_inode to fill_stack_inode_item() (git-fixes).
- btrfs: pass struct btrfs_inode to new_simple_dir() (git-fixes).
- btrfs: pass true to btrfs_delalloc_release_space() at btrfs_page_mkwrite() (bsc#1247949).
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (git-fixes).
- btrfs: props: switch prop_handler::apply to struct btrfs_inode (git-fixes).
- btrfs: props: switch prop_handler::extract to struct btrfs_inode (git-fixes).
- btrfs: push cleanup into btrfs_read_locked_inode() (git-fixes).
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (git-fixes).
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (git-fixes).
- btrfs: qgroup: remove no longer used fs_info->qgroup_ulist (git-fixes).
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (git-fixes).
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (git-fixes).
- btrfs: remove conditional path allocation in btrfs_read_locked_inode() (git-fixes).
- btrfs: remove no longer needed strict argument from can_nocow_extent() (git-fixes).
- btrfs: remove redundant path release when replaying a log tree (git-fixes).
- btrfs: remove the snapshot check from check_committed_ref() (git-fixes).
- btrfs: restore mount option info messages during mount (git-fixes).
- btrfs: return a btrfs_inode from btrfs_iget_logging() (git-fixes).
- btrfs: return a btrfs_inode from read_one_inode() (git-fixes).
- btrfs: return any hit error from extent_writepage_io() (git-fixes).
- btrfs: send: remove unnecessary inode lookup at send_encoded_inline_extent() (git-fixes).
- btrfs: simplify arguments for btrfs_cross_ref_exist() (git-fixes).
- btrfs: simplify early error checking in btrfs_page_mkwrite() (bsc#1247949).
- btrfs: simplify error detection flow during log replay (git-fixes).
- btrfs: simplify return logic at check_committed_ref() (git-fixes).
- btrfs: subpage: fix the bitmap dump of the locked flags (git-fixes).
- btrfs: tests: fix chunk map leak after failure to add it to the tree (git-fixes).
- btrfs: tree-checker: fix the incorrect inode ref size check (git-fixes).
- btrfs: unfold transaction aborts when replaying log trees (git-fixes).
- btrfs: unify ordering of btrfs_key initializations (git-fixes).
- btrfs: update superblock's device bytes_used when dropping chunk (git-fixes).
- btrfs: use a single variable to track return value at btrfs_page_mkwrite() (bsc#1247949).
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (git-fixes).
- btrfs: use filemap_get_folio() helper (git-fixes).
- btrfs: use struct btrfs_inode inside btrfs_get_name() (git-fixes).
- btrfs: use struct btrfs_inode inside btrfs_get_parent() (git-fixes).
- btrfs: use struct btrfs_inode inside btrfs_remap_file_range() (git-fixes).
- btrfs: use struct btrfs_inode inside btrfs_remap_file_range_prep() (git-fixes).
- btrfs: use struct btrfs_inode inside create_pending_snapshot() (git-fixes).
- btrfs: use verbose ASSERT() in volumes.c (bsc#1249038).
- build_bug.h: Add KABI assert (bsc#1249186).
- bus: firewall: Fix missing static inline annotations for stubs (git-fixes).
- bus: fsl-mc: Check return value of platform_get_resource() (git-fixes).
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (git-fixes).
- bus: mhi: ep: Fix chained transfer handling in read path (git-fixes).
- bus: mhi: host: Detect events pointing to unexpected TREs (git-fixes).
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (git-fixes).
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (git-fixes).
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (git-fixes).
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (stable-fixes).
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (git-fixes).
- can: j1939: implement NETDEV_UNREGISTER notification handler (git-fixes).
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (git-fixes).
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (git-fixes).
- can: kvaser_pciefd: Store device channel index (git-fixes).
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (git-fixes).
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (git-fixes).
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (git-fixes).
- can: peak_usb: fix USB FD devices potential malfunction (git-fixes).
- can: peak_usb: fix shift-out-of-bounds issue (git-fixes).
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (stable-fixes).
- can: rcar_canfd: Fix controller mode setting (stable-fixes).
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (git-fixes).
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (git-fixes).
- cdc-acm: fix race between initial clearing halt and open (git-fixes).
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (stable-fixes).
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (git-fixes).
- cgroup/cpuset: Fix a partition error with CPU hotplug (bsc#1241166).
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (bsc#1241166).
- cgroup: Add compatibility option for content of /proc/cgroups (jsc#PED-12405).
- cgroup: Print message when /proc/cgroups is read on v2-only system (jsc#PED-12405).
- cgroup: llist: avoid memory tears for llist_node (bsc#1247963).
- cgroup: make css_rstat_updated nmi safe (bsc#1247963).
- cgroup: remove per-cpu per-subsystem locks (bsc#1247963).
- cgroup: support to enable nmi-safe css_rstat_updated (bsc#1247963).
- char: misc: Fix improper and inaccurate error code returned by misc_init() (stable-fixes).
- clk: at91: peripheral: fix return value (git-fixes).
- clk: at91: sam9x7: update pll clk ranges (git-fixes).
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (git-fixes).
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (git-fixes).
- clk: imx95-blk-ctl: Fix synchronous abort (git-fixes).
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (git-fixes).
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (git-fixes).
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (git-fixes).
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (git-fixes).
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (git-fixes).
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (git-fixes).
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (git-fixes).
- clk: samsung: exynos850: fix a comment (git-fixes).
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (git-fixes).
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (git-fixes).
- clk: sunxi-ng: v3s: Fix de clock definition (git-fixes).
- clk: tegra: do not overallocate memory for bpmp clocks (git-fixes).
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (git-fixes).
- clk: xilinx: vcu: unregister pll_post only if registered correctly (git-fixes).
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (git-fixes).
- comedi: Make insn_rw_emulate_bits() do insn->n samples (git-fixes).
- comedi: fix race between polling and detaching (git-fixes).
- comedi: pcl726: Prevent invalid irq number (git-fixes).
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (stable-fixes).
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (git-fixes).
- config.sh: SLFO 1.2 branched in IBS
- config: arm64: default: enable mtu3 dual-role support for MediaTek platforms (bsc#1245206)
- coredump: Fixes core_pipe_limit sysctl proc_handler (git-fixes).
- cpu: Define attack vectors (git-fixes).
- cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume (git-fixes).
- cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor (git-fixes).
- cpufreq/sched: Explicitly synchronize limits_changed flag (git-fixes)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (git-fixes)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (stable-fixes).
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (stable-fixes).
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (stable-fixes).
- cpufreq: Exit governor when failed to start old governor (stable-fixes).
- cpufreq: Init policy->rwsem before it may be possibly used (git-fixes).
- cpufreq: Initialize cpufreq-based frequency-invariance later (git-fixes).
- cpufreq: Initialize cpufreq-based invariance before subsys (git-fixes).
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (stable-fixes git-fixes).
- cpufreq: Reference count policy in cpufreq_update_limits() (git-fixes).
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes).
- cpufreq: armada-8k: make both cpu masks static (git-fixes).
- cpufreq: cppc: Fix invalid return value in .get() callback (git-fixes).
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (git-fixes).
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (stable-fixes).
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (git-fixes).
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (git-fixes).
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (git-fixes).
- cpufreq: mediatek: fix device leak on probe failure (git-fixes).
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes).
- cpufreq: scmi: Skip SCMI devices that are not used by the CPUs (stable-fixes).
- cpufreq: scpi: compare kHz instead of Hz (git-fixes).
- cpufreq: sun50i: prevent out-of-bounds access (git-fixes).
- cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes).
- cpufreq: tegra186: Share policy per cluster (stable-fixes).
- cpupower: Fix a bug where the -t option of the set subcommand was not working (stable-fixes).
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (git-fixes).
- crypto: arm/aes-neonbs - work around gcc-15 warning (git-fixes).
- crypto: aspeed - Fix dma_unmap_sg() direction (git-fixes).
- crypto: atmel - Fix dma_unmap_sg() direction (git-fixes).
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (git-fixes).
- crypto: ccp - Add missing bootloader info reg for pspv6 (stable-fixes).
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (git-fixes).
- crypto: ccp - Fix locking on alloc failure handling (git-fixes).
- crypto: essiv - Check ssize for decryption and in-place encryption (git-fixes).
- crypto: hisilicon - re-enable address prefetch after device resuming (git-fixes).
- crypto: hisilicon/hpre - fix dma unmap sequence (stable-fixes).
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (git-fixes).
- crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs (git-fixes).
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (git-fixes).
- crypto: img-hash - Fix dma_unmap_sg() nents value (git-fixes).
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (git-fixes).
- crypto: jitter - fix intermediary handling (stable-fixes).
- crypto: keembay - Add missing check after sg_nents_for_len() (git-fixes).
- crypto: keembay - Fix dma_unmap_sg() nents value (git-fixes).
- crypto: marvell/cesa - Fix engine load inaccuracy (git-fixes).
- crypto: octeontx2 - Call strscpy() with correct size argument (git-fixes).
- crypto: octeontx2 - Fix address alignment issue on ucode loading (stable-fixes).
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (stable-fixes).
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (stable-fixes).
- crypto: octeontx2 - add timeout for load_fvc completion poll (stable-fixes).
- crypto: qat - allow enabling VFs in the absence of IOMMU (git-fixes).
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (git-fixes).
- crypto: qat - fix DMA direction for compression on GEN2 devices (git-fixes).
- crypto: qat - fix seq_file position update in adf_ring_next() (git-fixes).
- crypto: qat - fix state restore for banks with exceptions (git-fixes).
- crypto: qat - flush misc workqueue during device shutdown (git-fixes).
- crypto: qat - lower priority for skcipher and aead algorithms (stable-fixes).
- crypto: qat - use unmanaged allocation for dc_data (git-fixes).
- crypto: rng - Ensure set_ent is always present (git-fixes).
- crypto: rockchip - Fix dma_unmap_sg() nents value (git-fixes).
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (git-fixes).
- devlink: Add support for u64 parameters (jsc#PED-13331).
- devlink: avoid param type value translations (jsc#PED-13331).
- devlink: define enum for attr types of dynamic attributes (jsc#PED-13331).
- devlink: introduce devlink_nl_put_u64() (jsc#PED-13331).
- devlink: let driver opt out of automatic phys_port_name generation (git-fixes).
- dm-mpath: do not print the 'loaded' message if registering fails (git-fixes).
- dm-stripe: limit chunk_sectors to the stripe size (git-fixes).
- dm-table: fix checking for rq stackable devices (git-fixes).
- dm: Check for forbidden splitting of zone write operations (git-fixes).
- dm: split write BIOs on zone boundaries when zone append is not emulated (git-fixes).
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (stable-fixes).
- dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation (git-fixes).
- dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() (git-fixes).
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (git-fixes).
- dmaengine: fsl-dpaa2-qdma: Drop unused mc_enc() (git-fixes).
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (git-fixes).
- dmaengine: idxd: Fix refcount underflow on module unload (git-fixes).
- dmaengine: idxd: Remove improper idxd_free (git-fixes).
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (git-fixes).
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (git-fixes).
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (git-fixes).
- dmaengine: nbpfaxi: Add missing check after DMA map (git-fixes).
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (git-fixes).
- dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() (git-fixes).
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (stable-fixes).
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (git-fixes).
- docs: admin-guide: update to current minimum pipe size default (git-fixes).
- dpll: Add basic Microchip ZL3073x support (jsc#PED-13331).
- dpll: Make ZL3073X invisible (jsc#PED-13331).
- dpll: zl3073x: Add support to get/set frequency on pins (jsc#PED-13331).
- dpll: zl3073x: Add support to get/set priority on input pins (jsc#PED-13331).
- dpll: zl3073x: Fetch invariants during probe (jsc#PED-13331).
- dpll: zl3073x: Fix build failure (jsc#PED-13331).
- dpll: zl3073x: Implement input pin selection in manual mode (jsc#PED-13331).
- dpll: zl3073x: Implement input pin state setting in automatic mode (jsc#PED-13331).
- dpll: zl3073x: Read DPLL types and pin properties from system firmware (jsc#PED-13331).
- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-13331).
- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (jsc#PED-13331).
- driver core/PM: Set power.no_callbacks along with power.no_pm (stable-fixes).
- drivers/base/node: fix double free in register_one_node() (git-fixes).
- drivers/base/node: handle error properly in register_one_node() (git-fixes).
- drivers: base: handle module_kobject creation (git-fixes).
- drm/amd : Update MES API header file for v11 & v12 (stable-fixes).
- drm/amd/amdgpu: Declare isp firmware binary file (stable-fixes).
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (git-fixes).
- drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (stable-fixes).
- drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (git-fixes).
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (git-fixes).
- drm/amd/display: Add primary plane to commits for correct VRR handling (stable-fixes).
- drm/amd/display: Adjust DCE 8-10 clock, do not overclock by 15% (git-fixes).
- drm/amd/display: Allow DCN301 to clear update flags (git-fixes).
- drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put (git-fixes).
- drm/amd/display: Avoid a NULL pointer dereference (stable-fixes).
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (stable-fixes).
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (stable-fixes).
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (stable-fixes).
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (git-fixes).
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (stable-fixes).
- drm/amd/display: Disable DPCD Probe Quirk (bsc#1248121).
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (stable-fixes).
- drm/amd/display: Disable scaling on DCE6 for now (git-fixes).
- drm/amd/display: Do not check for NULL divisor in fixpt code (git-fixes).
- drm/amd/display: Do not overclock DCE 6 by 15% (git-fixes).
- drm/amd/display: Do not overwrite dce60_clk_mgr (git-fixes).
- drm/amd/display: Do not print errors for nonexistent connectors (git-fixes).
- drm/amd/display: Do not warn when missing DCE encoder caps (stable-fixes).
- drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (stable-fixes).
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (stable-fixes).
- drm/amd/display: Fix 'failed to blank crtc!' (stable-fixes).
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6 (stable-fixes).
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (stable-fixes).
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (git-fixes).
- drm/amd/display: Fix mismatch type comparison (stable-fixes).
- drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).
- drm/amd/display: Free memory allocation (stable-fixes).
- drm/amd/display: Init DCN35 clocks from pre-os HW values (git-fixes).
- drm/amd/display: Initialize mode_select to 0 (stable-fixes).
- drm/amd/display: Only finalize atomic_obj if it was initialized (stable-fixes).
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (git-fixes).
- drm/amd/display: Properly disable scaling on DCE6 (git-fixes).
- drm/amd/display: Remove redundant semicolons (git-fixes).
- drm/amd/display: Separate set_gsl from set_gsl_source_select (stable-fixes).
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (stable-fixes).
- drm/amd/display: add workaround flag to link to force FFE preset (stable-fixes).
- drm/amd/display: fix a Null pointer dereference vulnerability (stable-fixes).
- drm/amd/display: fix dmub access race condition (bsc#1243112).
- drm/amd/display: fix initial backlight brightness calculation (git-fixes).
- drm/amd/display: limit clear_update_flags to dcn32 and above (stable-fixes).
- drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).
- drm/amd/display: remove output_tf_change flag (git-fixes).
- drm/amd/display: use udelay rather than fsleep (git-fixes).
- drm/amd/include : MES v11 and v12 API header update (stable-fixes).
- drm/amd/include : Update MES v12 API for fence update (stable-fixes).
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (git-fixes).
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (git-fixes).
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (git-fixes).
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (git-fixes).
- drm/amd/pm: Disable ULV even if unsupported (v3) (git-fixes).
- drm/amd/pm: Fix si_upload_smc_data (v3) (git-fixes).
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (git-fixes).
- drm/amd/pm: fix null pointer access (stable-fixes).
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (stable-fixes).
- drm/amd: Avoid evicting resources at S5 (bsc#1243112).
- drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).
- drm/amd: Fix hybrid sleep (bsc#1243112).
- drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).
- drm/amd: Restore cached manual clock settings during resume (bsc#1243112).
- drm/amd: Restore cached power limit during resume (stable-fixes).
- drm/amdgpu/discovery: fix fw based ip discovery (git-fixes).
- drm/amdgpu/discovery: optionally use fw based ip discovery (stable-fixes).
- drm/amdgpu/gfx10: fix KGQ reset sequence (git-fixes).
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (git-fixes).
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (git-fixes).
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (git-fixes).
- drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).
- drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).
- drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).
- drm/amdgpu/mes: add missing locking in helper functions (stable-fixes).
- drm/amdgpu/mes: enable compute pipes across all MEC (git-fixes).
- drm/amdgpu/mes: optimize compute loop handling (stable-fixes).
- drm/amdgpu/swm14: Update power limit logic (stable-fixes).
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (stable-fixes).
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (stable-fixes).
- drm/amdgpu/vcn: fix ref counting for ring based profile handling (git-fixes).
- drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).
- drm/amdgpu: Add additional DCE6 SCL registers (git-fixes).
- drm/amdgpu: Avoid extra evict-restore process (stable-fixes).
- drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).
- drm/amdgpu: Enable MES lr_compute_wa by default (stable-fixes).
- drm/amdgpu: Fix allocating extra dwords for rings (v2) (git-fixes).
- drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).
- drm/amdgpu: Increase reset counter only on success (stable-fixes).
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (git-fixes).
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (git-fixes).
- drm/amdgpu: Remove nbiov7.9 replay count reporting (git-fixes).
- drm/amdgpu: Report individual reset error (bsc#1243112).
- drm/amdgpu: Reset the clear flag in buddy during resume (git-fixes).
- drm/amdgpu: Update external revid for GC v9.5.0 (stable-fixes).
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (stable-fixes).
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (stable-fixes).
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (stable-fixes).
- drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).
- drm/amdgpu: drop hw access in non-DC audio fini (stable-fixes).
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (git-fixes).
- drm/amdgpu: fix incorrect vm flags to map bo (git-fixes).
- drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).
- drm/amdgpu: fix task hang from failed job submission during process kill (git-fixes).
- drm/amdgpu: fix vram reservation issue (git-fixes).
- drm/amdgpu: remove the redeclaration of variable i (git-fixes).
- drm/amdgpu: update mmhub 3.0.1 client id mappings (stable-fixes).
- drm/amdgpu: update mmhub 4.1.0 client id mappings (stable-fixes).
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (stable-fixes).
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (git-fixes).
- drm/amdkfd: Fix mmap write lock not release (bsc#1243112).
- drm/ast: Use msleep instead of mdelay for edid read (git-fixes).
- drm/bridge: fix OF node leak (git-fixes).
- drm/bridge: it6505: select REGMAP_I2C (git-fixes).
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (git-fixes).
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (git-fixes).
- drm/cirrus-qemu: Fix pitch programming (git-fixes).
- drm/connector: hdmi: Evaluate limited range after computing format (git-fixes).
- drm/dp: Add an EDID quirk for the DPCD register access probe (bsc#1248121).
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (stable-fixes).
- drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET (bsc#1248121).
- drm/edid: Add support for quirks visible to DRM core and drivers (bsc#1248121).
- drm/edid: Define the quirks in an enum list (bsc#1248121).
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (stable-fixes).
- drm/gem: Internally test import_attach for imported objects (git-fixes).
- drm/gem: Test for imported GEM buffers with helper (stable-fixes).
- drm/gma500: Fix null dereference in hdmi teardown (git-fixes).
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (git-fixes).
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (git-fixes).
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (stable-fixes).
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (stable-fixes).
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (stable-fixes).
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (stable-fixes).
- drm/i915/ddi: only call shutdown hooks for valid encoders (stable-fixes).
- drm/i915/display: Fix dma_fence_wait_timeout() return value handling (git-fixes).
- drm/i915/display: add intel_encoder_is_hdmi() (stable-fixes).
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (git-fixes).
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (stable-fixes).
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (stable-fixes).
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (stable-fixes).
- drm/i915/icl+/tc: Cache the max lane count value (stable-fixes).
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (stable-fixes).
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (git-fixes).
- drm/imagination: Clear runtime PM errors while resetting the GPU (stable-fixes).
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (git-fixes).
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (git-fixes).
- drm/mediatek: fix potential OF node use-after-free (git-fixes).
- drm/msm/dp: account for widebus and yuv420 during mode validation (git-fixes).
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (git-fixes).
- drm/msm/dpu: fix incorrect type for ret (git-fixes).
- drm/msm/kms: move snapshot init earlier in KMS init (git-fixes).
- drm/msm: Add error handling for krealloc in metadata setup (stable-fixes).
- drm/msm: Defer fd_install in SUBMIT ioctl (git-fixes).
- drm/msm: update the high bitfield of certain DSI registers (git-fixes).
- drm/msm: use trylock for debugfs (stable-fixes).
- drm/nouveau/disp: Always accept linear modifier (git-fixes).
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (git-fixes).
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor() (git-fixes).
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (git-fixes).
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (git-fixes).
- drm/nouveau: fix typos in comments (git-fixes).
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (git-fixes).
- drm/nouveau: remove unused memory target test (git-fixes).
- drm/panel: novatek-nt35560: Fix invalid return value (git-fixes).
- drm/panfrost: Fix panfrost device variable name in devfreq (git-fixes).
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (git-fixes).
- drm/panthor: Defer scheduler entitiy destruction to queue release (git-fixes).
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (git-fixes).
- drm/panthor: validate group queue count (git-fixes).
- drm/radeon/r600_cs: clean up of dead code in r600_cs (git-fixes).
- drm/rcar-du: dsi: Fix 1/2/3 lane support (git-fixes).
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (git-fixes).
- drm/sched: Remove optimization that causes hang when killing dependent jobs (git-fixes).
- drm/simpledrm: Do not upcast in release helpers (git-fixes).
- drm/tests: Fix endian warning (git-fixes).
- drm/ttm: Respect the shrinker core free target (stable-fixes).
- drm/ttm: Should to return the evict error (stable-fixes).
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (git-fixes).
- drm/vmwgfx: Fix Use-after-free in validation (git-fixes).
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (git-fixes).
- drm/vmwgfx: Fix copy-paste typo in validation (git-fixes).
- drm/xe/bmg: Add new PCI IDs (stable-fixes).
- drm/xe/bmg: Add one additional PCI ID (stable-fixes).
- drm/xe/bmg: Update Wa_22019338487 (git-fixes).
- drm/xe/gsc: do not flush the GSC worker from the reset path (git-fixes).
- drm/xe/hw_engine_group: Fix double write lock release in error path (git-fixes).
- drm/xe/mocs: Initialize MOCS index early (stable-fixes).
- drm/xe/pf: Move VFs reprovisioning to worker (stable-fixes).
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (git-fixes).
- drm/xe/pf: Sanitize VF scratch registers on FLR (stable-fixes).
- drm/xe/tile: Release kobject for the failure path (git-fixes).
- drm/xe/uapi: Correct sync type definition in comments (git-fixes).
- drm/xe/uapi: loosen used tracking restriction (git-fixes).
- drm/xe/vf: Disable CSC support on VF (git-fixes).
- drm/xe/vm: Clear the scratch_pt pointer on error (git-fixes).
- drm/xe/xe_query: Use separate iterator while filling GT list (stable-fixes).
- drm/xe/xe_sync: avoid race during ufence signaling (git-fixes).
- drm/xe: Allow dropping kunit dependency as built-in (git-fixes).
- drm/xe: Attempt to bring bos back to VRAM after eviction (git-fixes).
- drm/xe: Carve out wopcm portion from the stolen memory (git-fixes).
- drm/xe: Do not trigger rebind on initial dma-buf validation (git-fixes).
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (git-fixes).
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (git-fixes).
- drm/xe: Fix build without debugfs (git-fixes).
- drm/xe: Make dma-fences compliant with the safe access rules (stable-fixes).
- drm/xe: Move page fault init after topology init (git-fixes).
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (git-fixes).
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (git-fixes).
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (stable-fixes).
- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-13331).
- dt-bindings: dpll: Add support for Microchip Azurite chip family (jsc#PED-13331).
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (git-fixes).
- e1000e: ignore uninitialized checksum word on tgp (git-fixes).
- efi: stmm: Fix incorrect buffer allocation method (git-fixes).
- erofs: avoid reading more for fragment maps (git-fixes).
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (git-fixes).
- execmem: enforce allocation size aligment to PAGE_SIZE (git-fixes).
- exfat: add cluster chain loop check for dir (git-fixes).
- exfat: fdatasync flag should be same like generic_write_sync() (git-fixes).
- ext4: fix checks for orphan inodes (bsc#1250119).
- ext4: remove writable userspace mappings before truncating page cache (bsc#1247223).
- fbcon: Fix OOB access in font allocation (git-fixes).
- fbcon: Fix outdated registered_fb reference in comment (git-fixes).
- fbcon: fix integer overflow in fbcon_do_set_font (git-fixes).
- fbdev: Fix logic error in 'offb' name match (git-fixes).
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (stable-fixes).
- fbdev: fix potential buffer overflow in do_register_framebuffer() (stable-fixes).
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (git-fixes).
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (git-fixes).
- fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT (git-fixes).
- firewire: core: fix overlooked update of subsystem ABI version (git-fixes).
- firewire: ohci: correct code comments about bus_reset tasklet (git-fixes).
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (stable-fixes).
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (git-fixes).
- firmware: arm_scmi: Fix up turbo frequencies selection (git-fixes).
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (git-fixes).
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (stable-fixes).
- firmware: firmware: meson-sm: fix compile-test default (git-fixes).
- firmware: meson_sm: fix device leak at probe (git-fixes).
- firmware: tegra: Fix IVC dependency problems (stable-fixes).
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (git-fixes).
- fs/nfs/io: make nfs_start_io_*() killable (git-fixes).
- fs/proc/task_mmu: check p->vec_buf for NULL (git-fixes).
- fs/proc: Use inode_get_dev() for device numbers in procmap_query References: bsc#1246450
- ftrace: Fix function profiler's filtering functionality (git-fixes).
- ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes).
- gfs2: Call gfs2_queue_verify_delete from gfs2_evict_inode (bsc#1247220).
- gfs2: Clean up delete work processing (bsc#1247220).
- gfs2: Faster gfs2_upgrade_iopen_glock wakeups (bsc#1247220).
- gfs2: Initialize gl_no_formal_ino earlier (bsc#1247220).
- gfs2: Minor delete_work_func cleanup (bsc#1247220).
- gfs2: Only defer deletes when we have an iopen glock (bsc#1247220).
- gfs2: Prevent inode creation race (2) (bsc#1247220).
- gfs2: Prevent inode creation race (bsc#1247220).
- gfs2: Randomize GLF_VERIFY_DELETE work delay (bsc#1247220).
- gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (bsc#1247220).
- gfs2: Rename dinode_demise to evict_behavior (bsc#1247220).
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (bsc#1247220).
- gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (bsc#1247220).
- gfs2: Simplify DLM_LKF_QUECVT use (bsc#1247220).
- gfs2: Update to the evict / remote delete documentation (bsc#1247220).
- gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (bsc#1247220).
- gfs2: gfs2_evict_inode clarification (bsc#1247220).
- gfs2: minor evict fix (bsc#1247220).
- gfs2: skip if we cannot defer delete (bsc#1247220).
- gpio: mlxbf2: use platform_get_irq_optional() (git-fixes).
- gpio: mlxbf3: use platform_get_irq_optional() (git-fixes).
- gpio: tps65912: check the return value of regmap_update_bits() (stable-fixes).
- gpio: virtio: Fix config space reading (git-fixes).
- gpio: wcd934x: check the return value of regmap_update_bits() (stable-fixes).
- gpio: wcd934x: mark the GPIO controller as sleeping (git-fixes).
- gpiolib: Extend software-node support to support secondary software-nodes (git-fixes).
- gve: Fix stuck TX queue for DQ queue format (git-fixes).
- gve: prevent ethtool ops after shutdown (git-fixes).
- habanalabs: fix UAF in export_dmabuf() (git-fixes).
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (stable-fixes).
- hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
- hv_netvsc: Link queues to NAPIs (git-fixes).
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (stable-fixes).
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (git-fixes).
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (git-fixes).
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (git-fixes).
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (git-fixes).
- hwrng: mtk - handle devm_pm_runtime_enable errors (git-fixes).
- hwrng: nomadik - add ARM_AMBA dependency (git-fixes).
- i2c: Force DLL0945 touchpad i2c freq to 100khz (stable-fixes).
- i2c: designware: Add disabling clocks when probe fails (git-fixes).
- i2c: designware: Add quirk for Intel Xe (stable-fixes).
- i2c: designware: Fix clock issue when PM is disabled (git-fixes).
- i2c: designware: Use temporary variable for struct device (stable-fixes).
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (git-fixes).
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (git-fixes).
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (git-fixes).
- i2c: omap: Add support for setting mux (stable-fixes).
- i2c: omap: Fix an error handling path in omap_i2c_probe() (git-fixes).
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (git-fixes).
- i2c: omap: fix deprecated of_property_read_bool() use (git-fixes).
- i2c: qup: jump out of the loop in case of timeout (git-fixes).
- i2c: riic: Allow setting frequencies lower than 50KHz (git-fixes).
- i2c: tegra: Fix reset error handling with ACPI (git-fixes).
- i2c: tegra: Use internal reset when reset property is not available (bsc#1249143)
- i2c: virtio: Avoid hang by using interruptible completion wait (git-fixes).
- i3c: Fix default I2C adapter timeout value (git-fixes).
- i3c: add missing include to internal header (stable-fixes).
- i3c: do not fail if GETHDRCAP is unsupported (stable-fixes).
- i3c: fix module_i3c_i2c_driver() with I3C=n (git-fixes).
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (stable-fixes).
- i3c: master: svc: Recycle unused IBI slot (git-fixes).
- i3c: master: svc: Use manual response for IBI events (git-fixes).
- i40e: When removing VF MAC filters, only check PF-set MAC (git-fixes).
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (git-fixes).
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (git-fixes).
- ice, irdma: fix an off by one in error handling code (bsc#1247712).
- ice, irdma: move interrupts code to irdma (bsc#1247712).
- ice/ptp: fix crosstimestamp reporting (git-fixes).
- ice: Fix signedness bug in ice_init_interrupt_scheme() (bsc#1247712).
- ice: Replace ice specific DSCP mapping num with a kernel define (jsc#PED-13728 jsc#PED-13762).
- ice: check correct pointer in fwlog debugfs (git-fixes).
- ice: count combined queues using Rx/Tx count (bsc#1247712).
- ice: devlink PF MSI-X max and min parameter (bsc#1247712).
- ice: do not leave device non-functional if Tx scheduler config fails (git-fixes).
- ice: enable_rdma devlink param (bsc#1247712).
- ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset (jsc#PED-13728).
- ice: fix incorrect counter for buffer allocation failures (git-fixes).
- ice: get rid of num_lan_msix field (bsc#1247712).
- ice: init flow director before RDMA (bsc#1247712).
- ice: remove splitting MSI-X between features (bsc#1247712).
- ice: simplify VF MSI-X managing (bsc#1247712).
- ice: treat dyn_allowed only as suggestion (bsc#1247712).
- ice: use fixed adapter index for E825C embedded devices (git-fixes).
- idpf: add PTP clock configuration (jsc#PED-13728 jsc#PED-13762).
- idpf: add Tx timestamp capabilities negotiation (jsc#PED-13728 jsc#PED-13762).
- idpf: add Tx timestamp flows (jsc#PED-13728 jsc#PED-13762).
- idpf: add cross timestamping (jsc#PED-13728).
- idpf: add flow steering support (jsc#PED-13728).
- idpf: add initial PTP support (jsc#PED-13728 jsc#PED-13762).
- idpf: add mailbox access to read PTP clock time (jsc#PED-13728 jsc#PED-13762).
- idpf: add support for Rx timestamping (jsc#PED-13728 jsc#PED-13762).
- idpf: add support for Tx refillqs in flow scheduling mode (jsc#PED-13728).
- idpf: assign extracted ptype to struct libeth_rqe_info field (jsc#PED-13728 jsc#PED-13762).
- idpf: change the method for mailbox workqueue allocation (jsc#PED-13728 jsc#PED-13762).
- idpf: fix UAF in RDMA core aux dev deinitialization (jsc#PED-13728).
- idpf: implement IDC vport aux driver MTU change handler (jsc#PED-13728 jsc#PED-13762).
- idpf: implement RDMA vport auxiliary dev create, init, and destroy (jsc#PED-13728 jsc#PED-13762).
- idpf: implement core RDMA auxiliary dev create, init, and destroy (jsc#PED-13728 jsc#PED-13762).
- idpf: implement get LAN MMIO memory regions (jsc#PED-13728 jsc#PED-13762).
- idpf: implement remaining IDC RDMA core callbacks and handlers (jsc#PED-13728 jsc#PED-13762).
- idpf: improve when to set RE bit logic (jsc#PED-13728).
- idpf: move virtchnl structures to the header file (jsc#PED-13728 jsc#PED-13762).
- idpf: negotiate PTP capabilities and get PTP clock (jsc#PED-13728 jsc#PED-13762).
- idpf: preserve coalescing settings across resets (jsc#PED-13728).
- idpf: remove obsolete stashing code (jsc#PED-13728).
- idpf: remove unreachable code from setting mailbox (jsc#PED-13728 jsc#PED-13762).
- idpf: replace flow scheduling buffer ring with buffer pool (jsc#PED-13728).
- idpf: set mac type when adding and removing MAC filters (jsc#PED-13728).
- idpf: simplify and fix splitq Tx packet rollback error path (jsc#PED-13728).
- idpf: stop Tx if there are insufficient buffer resources (jsc#PED-13728).
- idpf: use reserved RDMA vectors from control plane (jsc#PED-13728 jsc#PED-13762).
- igb: xsk: solve negative overflow of nb_pkts in zerocopy mode (git-fixes).
- igc: disable L1.2 PCI-E link substate to avoid performance issue (git-fixes).
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (git-fixes).
- iidc/ice/irdma: Break iidc.h into two headers (jsc#PED-13728 jsc#PED-13762).
- iidc/ice/irdma: Rename IDC header file (jsc#PED-13728 jsc#PED-13762).
- iidc/ice/irdma: Rename to iidc_* convention (jsc#PED-13728 jsc#PED-13762).
- iidc/ice/irdma: Update IDC to support multiple consumers (jsc#PED-13728 jsc#PED-13762).
- iio/adc/pac1934: fix channel disable configuration (git-fixes).
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (git-fixes).
- iio: accel: fxls8962af: Fix temperature calculation (git-fixes).
- iio: adc: ad7173: fix setting ODR in probe (git-fixes).
- iio: adc: ad7266: Fix potential timestamp alignment issue (git-fixes).
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (stable-fixes).
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp (git-fixes).
- iio: adc: ad_sigma_delta: change to buffer predisable (git-fixes).
- iio: adc: ad_sigma_delta: do not overallocate scan buffer (stable-fixes).
- iio: adc: dln2: Use aligned_s64 for timestamp (git-fixes).
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (stable-fixes).
- iio: adc: max1363: Reorder mode_list[] entries (stable-fixes).
- iio: chemical: pms7003: use aligned_s64 for timestamp (git-fixes).
- iio: chemical: sps30: use aligned_s64 for timestamp (git-fixes).
- iio: common: st_sensors: Fix use of uninitialize device structs (stable-fixes).
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (git-fixes).
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (git-fixes).
- iio: dac: ad5360: use int type to store negative error codes (git-fixes).
- iio: dac: ad5421: use int type to store negative error codes (git-fixes).
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (git-fixes).
- iio: frequency: adf4350: Fix prescaler usage (git-fixes).
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (git-fixes).
- iio: hid-sensor-prox: Restore lost scale assignments (git-fixes).
- iio: imu: bno055: fix OOB access of hw_xlate array (git-fixes).
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (stable-fixes).
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (git-fixes).
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (git-fixes).
- iio: imu: inv_icm42600: fix spi burst write not supported (git-fixes).
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (stable-fixes).
- iio: imu: inv_icm42600: use = { } instead of memset() (stable-fixes).
- iio: light: Use aligned_s64 instead of open coding alignment (stable-fixes).
- iio: light: as73211: Ensure buffer holes are zeroed (git-fixes).
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (git-fixes).
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (git-fixes).
- iio: proximity: isl29501: fix buffered read on big-endian systems (git-fixes).
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (git-fixes).
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (git-fixes).
- iio: xilinx-ams: Unmask interrupts after updating alarms (git-fixes).
- integrity/platform_certs: Allow loading of keys in the static key management mode (jsc#PED-13345 jsc#PED-13343).
- intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).
- intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
- intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).
- interconnect: qcom: sc8180x: specify num_nodes (git-fixes).
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (git-fixes).
- io_uring/rw: do not mask in f_iocb_flags (jsc#PED-12882 bsc#1237542). Drop blacklisting.
- io_uring: expose read/write attribute capability (jsc#PED-12882 bsc#1237542).
- io_uring: fix potential page leak in io_sqe_buffer_register() (git-fixes).
- iommu/amd: Enable PASID and ATS capabilities in the correct order (git-fixes).
- iommu/amd: Fix alias device DTE setting (git-fixes).
- iommu/amd: Fix geometry.aperture_end for V2 tables (git-fixes).
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (git-fixes).
- iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement (git-fixes).
- iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding (git-fixes).
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes).
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (git-fixes).
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (git-fixes).
- iommu/vt-d: Fix possible circular locking dependency (git-fixes).
- iommu/vt-d: Fix system hang on reboot -f (git-fixes).
- iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes).
- iommu: Handle race with default domain setup (git-fixes).
- iosys-map: Fix undefined behavior in iosys_map_clear() (git-fixes).
- ipmi: Fix strcpy source and destination the same (stable-fixes).
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (stable-fixes).
- ipv6: annotate data-races around rt->fib6_nsiblings (git-fixes).
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (git-fixes).
- ipv6: prevent infinite loop in rt6_nlmsg_size() (git-fixes).
- ipv6: reject malicious packets in ipv6_gso_segment() (git-fixes).
- ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems (git-fixes).
- irdma: free iwdev->rf after removing MSI-X (bsc#1247712).
- isolcpus: add missing hunk back (bsc#1236897 bsc#1249206).
- iwlwifi: Add missing check for alloc_ordered_workqueue (git-fixes).
- ixgbe: fix ixgbe_orom_civd_info struct layout (bsc#1245410).
- ixgbe: prevent from unwanted interface name changes (git-fixes).
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (git-fixes).
- kABI fix after Add TDX support for vSphere (jsc#PED-13302).
- kABI fix after KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).
- kABI fix after KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes).
- kABI fix after KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes).
- kABI fix after vhost: Reintroduce kthread API and add mode selection (git-fixes).
- kABI workaround for 'drm/dp: Add an EDID quirk for the DPCD register access probe' (bsc#1248121).
- kABI workaround for amd_sfh (git-fixes).
- kABI workaround for drm_gem.h (git-fixes).
- kABI workaround for struct mtk_base_afe changes (git-fixes).
- kABI: Fix the module::name type in audit_context (git-fixes).
- kABI: PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (git-fixes).
- kABI: arm64: ftrace: Restore struct mod_arch_specific layout (git-fixes).
- kABI: fix for struct devlink_port_attrs: move new member to the end (git-fixes).
- kABI: netfilter: supress warnings for nft_set_ops (git-fixes).
- kABI: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation (git-fixes).
- kabi/severities: ignore kABI compatibility in iio inv_icm42600 drivers They are used only locally
- kabi/severities: ignore two unused/dropped symbols from MEI
- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).
- kabi: Restore layout of parallel_data (bsc1248343).
- kabi: restore layout of struct cgroup_rstat_cpu (bsc#1247963).
- kasan: use vmalloc_dump_obj() for vmalloc error reports (git-fixes).
- kbuild/modpost: Continue processing all unresolved symbols when KLP_SYM_RELA is found (bsc#1218644, bsc#1250655).
- kbuild: rust: add rustc-min-version support function (git-fixes)
- kernel-binary: Another installation ordering fix (bsc#1241353).
- kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
- kernel: globalize lookup_or_create_module_kobject() (stable-fixes).
- kernel: param: rename locate_module_kobject (stable-fixes).
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (git-fixes).
- leds: flash: leds-qcom-flash: Update torch current clamp setting (git-fixes).
- leds: leds-lp50xx: Handle reg to get correct multi_index (stable-fixes).
- leds: leds-lp55xx: Use correct address for memory programming (git-fixes).
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (bsc#1236897).
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (git-fixes).
- libeth: move idpf_rx_csum_decoded and idpf_rx_extracted (jsc#PED-13728 jsc#PED-13762).
- livepatch: Add stack_order sysfs attribute (poo#187320).
- loop: use kiocb helpers to fix lockdep warning (git-fixes).
- lpfc: do not use file->f_path.dentry for comparisons (bsc#1250519).
- mISDN: Fix memory leak in dsp_hwec_enable() (git-fixes).
- mISDN: hfcpci: Fix warning when deleting uninitialized timer (git-fixes).
- mailbox: Not protect module_put with spin_lock_irqsave (stable-fixes).
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (git-fixes).
- mailbox: pcc: Always clear the platform ack interrupt first (stable-fixes).
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (stable-fixes).
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (stable-fixes).
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (git-fixes).
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (git-fixes).
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (git-fixes).
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (git-fixes).
- maple_tree: fix MAPLE_PARENT_RANGE32 and parent pointer docs (git-fixes).
- maple_tree: fix status setup on restore to active (git-fixes).
- maple_tree: fix testing for 32 bit builds (git-fixes).
- mctp: no longer rely on net->dev_index_head (git-fixes).
- md/raid1,raid10: strip REQ_NOWAIT from member bios (git-fixes).
- md: allow removing faulty rdev during resync (git-fixes).
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (git-fixes).
- md: make rdev_addable usable for rcu mode (git-fixes).
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (git-fixes).
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (git-fixes).
- media: cx18: Add missing check after DMA map (git-fixes).
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (stable-fixes).
- media: dvb-frontends: w7090p: fix null-ptr-deref in
w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (stable-fixes).
- media: gspca: Add bounds checking to firmware parser (git-fixes).
- media: hi556: Fix reset GPIO timings (stable-fixes).
- media: hi556: correct the test pattern configuration (git-fixes).
- media: i2c: mt9v111: fix incorrect type for ret (git-fixes).
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (git-fixes).
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (git-fixes).
- media: ipu-bridge: Add _HID for OV5670 (stable-fixes).
- media: ipu6: isys: Use correct pads for xlate_streams() (git-fixes).
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (git-fixes).
- media: lirc: Fix error handling in lirc_register() (git-fixes).
- media: mc: Fix MUST_CONNECT handling for pads with no links (git-fixes).
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (git-fixes).
- media: ov2659: Fix memory leaks in ov2659_probe() (git-fixes).
- media: pci: ivtv: Add missing check after DMA map (git-fixes).
- media: pci: mg4b: fix uninitialized iio scan data (git-fixes).
- media: pisp_be: Fix pm_runtime underrun in probe (git-fixes).
- media: qcom: camss: cleanup media device allocated resource on error path (git-fixes).
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (git-fixes).
- media: rc: fix races with imon_disconnect() (git-fixes).
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (git-fixes).
- media: s5p-mfc: remove an unused/uninitialized variable (git-fixes).
- media: st-delta: avoid excessive stack usage (git-fixes).
- media: tc358743: Check I2C succeeded during probe (stable-fixes).
- media: tc358743: Increase FIFO trigger level to 374 (stable-fixes).
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (stable-fixes).
- media: ti: j721e-csi2rx: Fix source subdev link creation (git-fixes).
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (git-fixes).
- media: ti: j721e-csi2rx: fix list_del corruption (git-fixes).
- media: tuner: xc5000: Fix use-after-free in xc5000_release (git-fixes).
- media: usb: hdpvr: disable zero-length read messages (stable-fixes).
- media: usbtv: Lock resolution while streaming (git-fixes).
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (stable-fixes).
- media: uvcvideo: Do not mark valid metadata as invalid (git-fixes).
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (git-fixes).
- media: uvcvideo: Fix bandwidth issue for Alcor camera (stable-fixes).
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (git-fixes).
- media: uvcvideo: Rollback non processed entities on error (git-fixes).
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (stable-fixes).
- media: v4l2-ctrls: Do not reset handler's error in v4l2_ctrl_handler_free() (git-fixes).
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (git-fixes).
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (git-fixes).
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (git-fixes).
- media: venus: Add a check for packet size after reading from shared memory (git-fixes).
- media: venus: Fix MSM8998 frequency table (git-fixes).
- media: venus: Fix OOB read due to missing payload bound check (git-fixes).
- media: venus: firmware: Use correct reset sequence for IRIS2 (git-fixes).
- media: venus: hfi: explicitly release IRQ during teardown (git-fixes).
- media: venus: protect against spurious interrupts during probe (git-fixes).
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240 (git-fixes).
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (git-fixes).
- media: verisilicon: Fix AV1 decoder clock frequency (git-fixes).
- media: vivid: fix wrong pixel_array control size (git-fixes).
- media: zoran: Remove zoran_fh structure (git-fixes).
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (stable-fixes).
- mei: vsc: Destroy mutex after freeing the IRQ (git-fixes).
- mei: vsc: Do not re-init VSC from mei_vsc_hw_reset() on stop (git-fixes).
- mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq() (stable-fixes).
- mei: vsc: Event notifier fixes (git-fixes).
- mei: vsc: Fix 'BUG: Invalid wait context' lockdep error (git-fixes).
- mei: vsc: Run event callback from a workqueue (git-fixes).
- mei: vsc: Unset the event callback on remove and probe errors (git-fixes).
- memory: mtk-smi: Add ostd setting for mt8186 (git-fixes).
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (git-fixes).
- memstick: Fix deadlock by moving removing flag earlier (git-fixes).
- mfd: axp20x: Set explicit ID for AXP313 regulator (stable-fixes).
- mfd: cros_ec: Separate charge-control probing from USB-PD (git-fixes).
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (git-fixes).
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (git-fixes).
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (git-fixes).
- microchip: lan865x: Fix LAN8651 autoloading (git-fixes).
- microchip: lan865x: Fix module autoloading (git-fixes).
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (git-fixes).
- microchip: lan865x: fix missing netif_start_queue() call on device open (git-fixes).
- misc: fastrpc: Fix fastrpc_map_lookup operation (git-fixes).
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes).
- misc: fastrpc: Skip reference for DMA handles (git-fixes).
- misc: fastrpc: fix possible map leak in fastrpc_put_args (git-fixes).
- misc: genwqe: Fix incorrect cmd field being reported in error (git-fixes).
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (git-fixes).
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (stable-fixes).
- misc: rtsx: usb: Ensure mmc child device is active when card is present (git-fixes).
- mm/damon/core: avoid destroyed target reference from DAMOS quota (git-fixes).
- mm/damon/core: prevent unnecessary overflow in damos_set_effective_quota() (git-fixes).
- mm/damon/core: set quota->charged_from to jiffies at first charge window (git-fixes).
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (git-fixes).
- mm/damon/ops-common: ignore migration request to invalid nodes (git-fixes).
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (git-fixes).
- mm/damon/sysfs: fix use-after-free in state_show() (git-fixes).
- mm/memory-failure: fix redundant updates for already poisoned pages (bsc#1250087).
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (git-fixes)
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (git-fixes).
- mm: close theoretical race where stale TLB entries could linger (git-fixes).
- mm: fault in complete folios instead of individual pages for tmpfs (git-fixes).
- mm: fix the inaccurate memory statistics issue for users (bsc#1244723).
- mm: introduce and use {pgd,p4d}_populate_kernel() (git-fixes).
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (git-fixes).
- mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting (bsc#1245630).
- mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting - kabi (bsc#1245630).
- mm: move page table sync declarations to linux/pgtable.h (git-fixes).
- mm: swap: fix potential buffer overflow in setup_clusters() (git-fixes).
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (git-fixes).
- mmc: mvsdio: Fix dma_unmap_sg() nents value (git-fixes).
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (stable-fixes).
- mmc: sdhci-cadence: add Mobileye eyeQ support (stable-fixes).
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (stable-fixes).
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (stable-fixes).
- mmc: sdhci-of-arasan: Support for emmc hardware reset (stable-fixes).
- mmc: sdhci-pci-gli: Add a new function to simplify the code (git-fixes).
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (git-fixes).
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (git-fixes).
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (git-fixes).
- module: Fix memory deallocation on error path in move_module() (git-fixes).
- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).
- module: Remove unnecessary +1 from last_unloaded_module::name size (git-fixes).
- module: Restore the moduleparam prefix length check (git-fixes).
- most: core: Drop device reference after usage in get_channel() (git-fixes).
- mptcp: fix spurious wake-up on under memory pressure (git-fixes).
- mtd: fix possible integer overflow in erase_xfer() (git-fixes).
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (git-fixes).
- mtd: rawnand: atmel: Fix dma_mapping_error() address (git-fixes).
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (git-fixes).
- mtd: rawnand: atmel: set pmecc data setup time (git-fixes).
- mtd: rawnand: fsmc: Add missing check after DMA map (git-fixes).
- mtd: rawnand: omap2: fix device leak on probe failure (git-fixes).
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (git-fixes).
- mtd: rawnand: renesas: Add missing check after DMA map (git-fixes).
- mtd: rawnand: rockchip: Add missing check after DMA map (git-fixes).
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (git-fixes).
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (git-fixes).
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (git-fixes).
- mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER (git-fixes).
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (git-fixes).
- mwl8k: Add missing check after DMA map (git-fixes).
- neighbour: Fix null-ptr-deref in neigh_flush_dev() (git-fixes).
- net/mlx5: Base ECVF devlink port attrs from 0 (git-fixes).
- net/mlx5: CT: Use the correct counter offset (git-fixes).
- net/mlx5: Check device memory pointer before usage (git-fixes).
- net/mlx5: Correctly set gso_segs when LRO is used (git-fixes).
- net/mlx5: Correctly set gso_size when LRO is used (git-fixes).
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (git-fixes).
- net/mlx5: Fix lockdep assertion on sync reset unload event (git-fixes).
- net/mlx5: Fix memory leak in cmd_exec() (git-fixes).
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (git-fixes).
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (git-fixes).
- net/mlx5: HWS, fix bad parameter in CQ creation (git-fixes).
- net/mlx5: Nack sync reset when SFs are present (git-fixes).
- net/mlx5: Prevent flow steering mode changes in switchdev mode (git-fixes).
- net/mlx5: Reload auxiliary drivers on fw_activate (git-fixes).
- net/mlx5e: Add new prio for promiscuous mode (git-fixes).
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (git-fixes).
- net/mlx5e: Preserve shared buffer capacity during headroom updates (git-fixes).
- net/mlx5e: Remove skb secpath if xfrm state is not found (git-fixes).
- net/mlx5e: Set local Xoff after FW update (git-fixes).
- net/mlx5e: Update and set Xon/Xoff upon MTU set (git-fixes).
- net/mlx5e: Update and set Xon/Xoff upon port speed set (git-fixes).
- net/packet: fix a race in packet_set_ring() and packet_notifier() (git-fixes).
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (git-fixes).
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (git-fixes).
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (git-fixes).
- net/sched: taprio: enforce minimum value for picos_per_byte (git-fixes).
- net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll (git-fixes).
- net: 802: LLC+SNAP OID:PID lookup on start of skb data (git-fixes).
- net: dsa: restore dsa_software_vlan_untag() ability to operate on VLAN-untagged traffic (git-fixes).
- net: dsa: tag_ocelot_8021q: fix broken reception (git-fixes).
- net: hsr: fix fill_frame_info() regression vs VLAN packets (git-fixes).
- net: hsr: fix hsr_init_sk() vs network/transport headers (git-fixes).
- net: hv_netvsc: fix loss of early receive events from host during channel open (git-fixes).
- net: ieee8021q: fix insufficient table-size assertion (stable-fixes).
- net: llc: reset skb->transport_header (git-fixes).
- net: mana: Add handler for hardware servicing events (bsc#1245730).
- net: mana: Add speed support in mana_get_link_ksettings (bsc#1245726).
- net: mana: Add support for net_shaper_ops (bsc#1245726).
- net: mana: Allocate MSI-X vectors dynamically (bsc#1245457).
- net: mana: Allow irq_setup() to skip cpus for affinity (bsc#1245457).
- net: mana: Expose additional hardware counters for drop and TC via ethtool (bsc#1245729).
- net: mana: Fix build errors when CONFIG_NET_SHAPER is disabled (gix-fixes).
- net: mana: Fix potential deadlocks in mana napi ops (bsc#1245726).
- net: mana: Handle Reset Request from MANA NIC (bsc#1245728).
- net: mana: Handle unsupported HWC commands (bsc#1245726).
- net: mana: Set tx_packets to post gso processing packet count (bsc#1245731).
- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).
- net: mana: explain irq_setup() algorithm (bsc#1245457).
- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).
- net: mctp: handle skb cleanup on sock_queue failures (git-fixes).
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (git-fixes).
- net: nfc: nci: Add parameter validation for packet data (git-fixes).
- net: page_pool: allow enabling recycling late, fix false positive warning (git-fixes).
- net: phy: bcm54811: PHY initialization (stable-fixes).
- net: phy: fix phy_uses_state_machine() (git-fixes).
- net: phy: micrel: Add ksz9131_resume() (stable-fixes).
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (git-fixes).
- net: phy: smsc: add proper reset flags for LAN8710A (stable-fixes).
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (git-fixes).
- net: rose: convert 'use' field to refcount_t (git-fixes).
- net: rose: fix a typo in rose_clear_routes() (git-fixes).
- net: rose: include node references in rose_neigh refcount (git-fixes).
- net: rose: split remove and free operations in rose_remove_neigh() (stable-fixes).
- net: thunderbolt: Enable end-to-end flow control also in transmit (stable-fixes).
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (stable-fixes).
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (git-fixes).
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (git-fixes).
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (git-fixes).
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (git-fixes).
- net: usb: cdc-ncm: check for filtering capability (git-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (stable-fixes).
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (git-fixes).
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (stable-fixes).
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (stable-fixes).
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (git-fixes).
- net: usbnet: Fix the wrong netif_carrier_on() call (git-fixes).
- netfilter: ctnetlink: fix refcount leak on table dump (git-fixes).
- netfilter: ctnetlink: remove refcounting in expectation dumpers (git-fixes).
- netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around (git-fixes).
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (git-fixes).
- netfilter: nf_reject: do not leak dst refcount for loopback packets (git-fixes).
- netfilter: nf_tables: Drop dead code from fill_*_info routines (git-fixes).
- netfilter: nf_tables: adjust lockdep assertions handling (git-fixes).
- netfilter: nf_tables: fix set size with rbtree backend (git-fixes).
- netfilter: nf_tables: imbalance in flowtable binding (git-fixes).
- netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template (git-fixes).
- netfilter: nft_flow_offload: update tcp state flags under lock (git-fixes).
- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
- netfilter: nft_set_hash: skip duplicated elements pending gc run (git-fixes).
- netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext (git-fixes).
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (git-fixes).
- netfilter: nft_tunnel: fix geneve_opt dump (git-fixes).
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (git-fixes).
- netlink: fix policy dump for int with validation callback (jsc#PED-13331).
- netlink: specs: devlink: replace underscores with dashes in names (jsc#PED-13331).
- netpoll: prevent hanging NAPI when netcons gets enabled (git-fixes).
- nfs/localio: add direct IO enablement with sync and async IO support (git-fixes).
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (git-fixes).
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (git-fixes).
- nfsd: fix access checking for NLM under XPRTSEC policies (git-fixes).
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (git-fixes).
- nouveau: fix disabling the nonstall irq due to storm code (git-fixes).
- nvme-auth: update bi_directional flag (git-fixes).
- nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).
- nvme-pci: try function level reset on init failure (git-fixes).
- nvme-tcp: log TLS handshake failures at error level (git-fixes).
- nvme-tcp: send only permitted commands for secure concat (git-fixes).
- nvme: fix PI insert on write (git-fixes).
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (git-fixes).
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (git-fixes).
- nvme: fix misaccounting of nvme-mpath inflight I/O (git-fixes).
- nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).
- nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).
- nvmet-tcp: fix callback lock for TLS handshake (git-fixes).
- nvmet: exit debugfs after discovery subsystem exits (git-fixes).
- nvmet: initialize discovery subsys after debugfs is initialized (git-fixes).
- nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails (git-fixes).
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (stable-fixes).
- objtool, lkdtm: Obfuscate the do_nothing() pointer (stable-fixes).
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (stable-fixes).
- of: dynamic: Fix memleak when of_pci_add_properties() failed (git-fixes).
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (git-fixes).
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (git-fixes).
- of: resolver: Simplify of_resolve_phandles() using __free() (stable-fixes).
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (git-fixes).
- of: unittest: Unlock on error in unittest_data_add() (git-fixes).
- pNFS/flexfiles: do not attempt pnfs on fatal DS errors (git-fixes).
- pNFS: Fix disk addr range check in block/scsi layout (git-fixes).
- pNFS: Fix stripe mapping in block/scsi layout (git-fixes).
- pNFS: Fix uninited ptr deref in block/scsi layout (git-fixes).
- pNFS: Handle RPC size limit for layoutcommits (git-fixes).
- percpu: fix race on alloc failed warning limit (git-fixes).
- perf bpf-event: Fix use-after-free in synthesis (git-fixes).
- perf bpf-utils: Constify bpil_array_desc (git-fixes).
- perf bpf-utils: Harden get_bpf_prog_info_linear (git-fixes).
- perf dso: Add missed dso__put to dso__load_kcore (git-fixes).
- perf hwmon_pmu: Avoid shortening hwmon PMU name (git-fixes).
- perf parse-events: Set default GH modifier properly (git-fixes).
- perf record: Cache build-ID of hit DSOs only (git-fixes).
- perf sched: Fix memory leaks for evsel->priv in timehist (git-fixes).
- perf sched: Fix memory leaks in 'perf sched latency' (git-fixes).
- perf sched: Fix memory leaks in 'perf sched map' (git-fixes).
- perf sched: Fix thread leaks in 'perf sched timehist' (git-fixes).
- perf sched: Free thread->priv using priv_destructor (git-fixes).
- perf sched: Make sure it frees the usage string (git-fixes).
- perf sched: Use RC_CHK_EQUAL() to compare pointers (git-fixes).
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (git-fixes).
- perf test: Fix a build error in x86 topdown test (git-fixes).
- perf tests bp_account: Fix leaked file descriptor (git-fixes).
- perf tools: Remove libtraceevent in .gitignore (git-fixes).
- perf topdown: Use attribute to see an event is a topdown metic or slots (git-fixes).
- perf trace: Remove --map-dump documentation (git-fixes).
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (git-fixes).
- phy: mscc: Fix parsing of unicast frames (git-fixes).
- phy: mscc: Fix timestamping for vsc8584 (git-fixes).
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (git-fixes).
- phy: qualcomm: phy-qcom-eusb2-repeater: Do not zero-out registers (git-fixes).
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (git-fixes).
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (stable-fixes).
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (git-fixes).
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case of errors (git-fixes).
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (git-fixes).
- phy: tegra: xusb: fix device and OF node leak at probe (git-fixes).
- phy: ti-pipe3: fix device leak at unbind (git-fixes).
- phy: ti: omap-usb2: fix device leak at unbind (git-fixes).
- pidfs: Fix memory leak in pidfd_info() (jsc#PED-13113).
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (bsc#1249562).
- pinctrl: STMFX: add missing HAS_IOMEM dependency (git-fixes).
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (git-fixes).
- pinctrl: equilibrium: Remove redundant semicolons (git-fixes).
- pinctrl: meson-gxl: add missing i2c_d pinmux (git-fixes).
- pinctrl: renesas: Use int type to store negative error codes (git-fixes).
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (git-fixes).
- pinctrl: samsung: Drop unused S3C24xx driver data (git-fixes).
- pinctrl: stm32: Manage irq affinity settings (stable-fixes).
- pinctrl: sunxi: Fix memory leak on krealloc failure (git-fixes).
- pinmux: fix race causing mux_owner NULL with active mux_usecount (git-fixes).
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (git-fixes).
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (stable-fixes).
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (stable-fixes).
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (git-fixes).
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (git-fixes).
- platform/mellanox: mlxbf-pmc: Validate event/enable input (git-fixes).
- platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (git-fixes).
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (stable-fixes).
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (stable-fixes).
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (stable-fixes).
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (stable-fixes).
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (stable-fixes).
- platform/x86/intel-uncore-freq: Check write blocked for ELC (git-fixes).
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (git-fixes).
- platform/x86: Fix initialization order for firmware_attributes_class (git-fixes).
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (stable-fixes).
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (stable-fixes).
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (git-fixes).
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (git-fixes).
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (git-fixes).
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (git-fixes).
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (git-fixes).
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (stable-fixes).
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (stable-fixes).
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (git-fixes).
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (git-fixes).
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (git-fixes).
- power: supply: cw2015: Fix a alignment coding style issue (git-fixes).
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (git-fixes).
- power: supply: max77976_charger: fix constant current reporting (git-fixes).
- power: supply: qcom_battmgr: Add lithium-polymer entry (stable-fixes).
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (git-fixes).
- powerpc/eeh: Export eeh_unfreeze_pe() (bsc#1215199).
- powerpc/eeh: Make EEH driver device hotplug safe (bsc#1215199).
- powerpc/ftrace: ensure ftrace record ops are always set for NOPs (git-fixes).
- powerpc/ftrace: ensure ftrace record ops are always set for NOPs (jsc#PED-10909 git-fixes).
- powerpc/kernel: Fix ppc_save_regs inclusion in build (bsc#1215199).
- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).
- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).
- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).
- powerpc/pseries: Correct secvar format representation for static key management (jsc#PED-13345 jsc#PED-13343).
- powerpc/secvar: Expose secvars relevant to the key management mode (jsc#PED-13345 jsc#PED-13343).
- powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs (jsc#PED-10909 git-fixes).
- powerpc: do not build ppc_save_regs.o always (bsc#1215199).
- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).
- pptp: fix pptp_xmit() error path (git-fixes).
- printk: nbcon: Allow reacquire during panic (bsc#1246688).
- psample: adjust size if rate_as_probability is set (git-fixes).
- ptp: fix breakage after ptp_vclock_in_use() rework (git-fixes).
- pwm: berlin: Fix wrong register in suspend/resume (git-fixes).
- pwm: imx-tpm: Reset counter if CMOD is 0 (git-fixes).
- pwm: mediatek: Fix duty and period setting (git-fixes).
- pwm: mediatek: Handle hardware enable and clock enable separately (stable-fixes).
- pwm: rockchip: Round period/duty down on apply, up on get (git-fixes).
- pwm: tiehrpwm: Do not drop runtime PM reference in .free() (git-fixes).
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (git-fixes).
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (git-fixes).
- pwm: tiehrpwm: Make code comment in .free() more useful (git-fixes).
- r8169: add support for RTL8125D (stable-fixes).
- r8169: disable RTL8126 ZRX-DC timeout (stable-fixes).
- r8169: do not scan PHY addresses > 0 (stable-fixes).
- rcu: Fix racy re-initialization of irq_work causing hangs (git-fixes)
- regmap: Remove superfluous check for !config in __regmap_init() (git-fixes).
- regulator: core: fix NULL dereference on unbind due to stale coupling data (stable-fixes).
- regulator: scmi: Use int type to store negative error codes (git-fixes).
- regulator: sy7636a: fix lifecycle of power good gpio (git-fixes).
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (stable-fixes).
- reset: eyeq: fix OF node leak (git-fixes).
- resource: Add resource set range and size helpers (jsc#PED-13728 jsc#PED-13762).
- resource: fix false warning in __request_region() (git-fixes).
- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() (git-fixes).
- ring-buffer: Make reading page consistent with the code logic (git-fixes).
- rpm/config.sh: SLFO 1.2 is now synced to OBS as well
- rtc: ds1307: fix incorrect maximum clock rate handling (git-fixes).
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (stable-fixes).
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (stable-fixes).
- rtc: hym8563: fix incorrect maximum clock rate handling (git-fixes).
- rtc: nct3018y: fix incorrect maximum clock rate handling (git-fixes).
- rtc: optee: fix memory leak on driver removal (git-fixes).
- rtc: pcf85063: fix incorrect maximum clock rate handling (git-fixes).
- rtc: pcf8563: fix incorrect maximum clock rate handling (git-fixes).
- rtc: rv3028: fix incorrect maximum clock rate handling (git-fixes).
- rtc: x1205: Fix Xicor X1205 vendor prefix (git-fixes).
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (git-fixes bsc#1247837).
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (git-fixes bsc#1246868).
- s390/cpum_cf: Deny all sampling events by counter PMU (git-fixes bsc#1249477).
- s390/early: Copy last breaking event address to pt_regs (git-fixes bsc#1249061).
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (bsc#1248727 git-fixes).
- s390/hypfs: Enable limited access during lockdown (bsc#1248727 git-fixes).
- s390/ism: fix concurrency management in ism_cmd() (git-fixes bsc#1247372).
- s390/mm: Allocate page table with PAGE_SIZE granularity (git-fixes bsc#1247838).
- s390/mm: Do not map lowcore with identity mapping (git-fixes bsc#1249066).
- s390/mm: Remove possible false-positive warning in pte_free_defer() (git-fixes bsc#1247366).
- s390/pai: Deny all events not handled by this PMU (git-fixes bsc#1249478).
- s390/pci: Allow automatic recovery with minimal driver support (bsc#1248728 git-fixes).
- s390/sclp: Fix SCCB present check (git-fixes bsc#1249065).
- s390/stp: Remove udelay from stp_sync_clock() (git-fixes bsc#1249062).
- s390/time: Use monotonic clock in get_cycles() (git-fixes bsc#1249064).
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes).
- samples: mei: Fix building on musl libc (git-fixes).
- sched/deadline: Always stop dl-server before changing parameters (bsc#1247936).
- sched/deadline: Do not count nr_running for dl_server proxy tasks (git-fixes, bsc#1247936).
- sched/deadline: Fix RT task potential starvation when expiry time passed (git-fixes, bsc#1247936).
- sched/deadline: Fix dl_server_stopped() (bsc#1247936).
- sched/deadline: Initialize dl_servers after SMP (git-fixes)
- sched_ext, sched/core: Do not call scx_group_set_weight() (git-fixes)
- scsi: Revert 'scsi: iscsi: Fix HW conn removal use after free' (git-fixes).
- scsi: core: Fix kernel doc for scsi_track_queue_full() (git-fixes).
- scsi: elx: efct: Fix dma_unmap_sg() nents value (git-fixes).
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (git-fixes).
- scsi: isci: Fix dma_unmap_sg() nents value (git-fixes).
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).
- scsi: lpfc: Clean up extraneous phba dentries (bsc#1250519).
- scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int (bsc#1250519).
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (bsc#1250519).
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).
- scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).
- scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).
- scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).
- scsi: lpfc: Use int type to store negative error codes (bsc#1250519).
- scsi: lpfc: Use switch case statements in DIF debugfs handlers (bsc#1250519).
- scsi: lpfc: use min() to improve code (bsc#1250519).
- scsi: mpi3mr: Event processing debug improvement (bsc#1251186).
- scsi: mpi3mr: Fix I/O failures during controller reset (bsc#1251186).
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (bsc#1251186).
- scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed (bsc#1251186).
- scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (git-fixes).
- scsi: mpi3mr: Fix premature TM timeouts on virtual drives (bsc#1251186).
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (git-fixes).
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (git-fixes).
- scsi: mpi3mr: Update MPI headers to revision 37 (bsc#1251186).
- scsi: mpi3mr: Update driver version to 8.15.0.5.50 (bsc#1251186).
- scsi: mpt3sas: Fix a fw_event memory leak (git-fixes).
- scsi: mvsas: Fix dma_unmap_sg() nents value (git-fixes).
- scsi: qla2xxx: Avoid stack frame size warning in qla_dfs (git-fixes).
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (git-fixes).
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (git-fixes).
- scsi: qla2xxx: Remove firmware URL (git-fixes).
- scsi: qla2xxx: Use secs_to_jiffies() instead of msecs_to_jiffies() (git-fixes).
- scsi: qla2xxx: edif: Fix incorrect sign of error code (git-fixes).
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (git-fixes).
- scsi: smartpqi: Enhance WWID logging logic (bsc#1246631).
- scsi: smartpqi: Take drives offline when controller is offline (bsc#1246631).
- scsi: smartpqi: Update driver version to 2.1.34-035 (bsc#1246631).
- scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed (git-fixes).
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (git-fixes).
- scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails (git-fixes).
- scsi: ufs: core: Add missing post notify for power mode change (git-fixes).
- scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG (git-fixes).
- scsi: ufs: core: Always initialize the UIC done completion (git-fixes).
- scsi: ufs: core: Do not perform UFS clkscaling during host async scan (git-fixes).
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (git-fixes).
- scsi: ufs: core: Fix error return with query response (git-fixes).
- scsi: ufs: core: Fix spelling of a sysfs attribute name (git-fixes).
- scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out() (git-fixes).
- scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers (git-fixes).
- scsi: ufs: core: Improve ufshcd_mcq_sq_cleanup() (git-fixes).
- scsi: ufs: core: Introduce ufshcd_has_pending_tasks() (git-fixes).
- scsi: ufs: core: Prepare to introduce a new clock_gating lock (git-fixes).
- scsi: ufs: core: Remove redundant query_complete trace (git-fixes).
- scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init() (git-fixes).
- scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe (git-fixes).
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (git-fixes).
- scsi: ufs: exynos: Add check inside exynos_ufs_config_smu() (git-fixes).
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (git-fixes).
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (git-fixes).
- scsi: ufs: exynos: Ensure consistent phy reference counts (git-fixes).
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (git-fixes).
- scsi: ufs: exynos: Fix hibern8 notify callbacks (git-fixes).
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (git-fixes).
- scsi: ufs: exynos: Move UFS shareability value to drvdata (git-fixes).
- scsi: ufs: exynos: Move phy calls to .exit() callback (git-fixes).
- scsi: ufs: exynos: Remove empty drv_init method (git-fixes).
- scsi: ufs: exynos: Remove superfluous function parameter (git-fixes).
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (git-fixes).
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (git-fixes).
- scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers (git-fixes).
- scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() (git-fixes).
- scsi: ufs: qcom: Fix crypto key eviction (git-fixes).
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (git-fixes).
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (git-fixes).
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (git-fixes).
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (git-fixes bsc#1250671).
- selftest/livepatch: Only run test-kprobe with CONFIG_KPROBES_ON_FTRACE (poo#187320).
- selftests/cpufreq: Fix cpufreq basic read and update testcases (bsc#1250344).
- selftests/livepatch: Ignore NO_SUPPORT line in dmesg (poo#187320).
- selftests/livepatch: Replace hardcoded module name with variable in test-callbacks.sh (poo#187320).
- selftests/run_kselftest.sh: Fix help string for --per-test-log (poo#187320).
- selftests/run_kselftest.sh: Use readlink if realpath is not available (poo#187320).
- selftests/tracing: Fix false failure of subsystem event test (git-fixes).
- selftests: ALSA: fix memory leak in utimer test (git-fixes).
- selftests: livepatch: add new ftrace helpers functions (poo#187320).
- selftests: livepatch: add test cases of stack_order sysfs interface (poo#187320).
- selftests: livepatch: handle PRINTK_CALLER in check_result() (poo#187320).
- selftests: livepatch: rename KLP_SYSFS_DIR to SYSFS_KLP_DIR (poo#187320).
- selftests: livepatch: save and restore kprobe state (poo#187320).
- selftests: livepatch: test if ftrace can trace a livepatched function (poo#187320).
- selftests: livepatch: test livepatching a kprobed function (poo#187320).
- selftests: ncdevmem: Move ncdevmem under drivers/net/hw (poo#187443).
- selinux: change security_compute_sid to return the ssid or tsid on match (git-fixes).
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (stable-fixes).
- serial: 8250: Touch watchdogs in write_atomic() (bsc#1246688).
- serial: 8250: fix panic due to PSLVERR (git-fixes).
- serial: max310x: Add error checking in probe() (git-fixes).
- serial: sc16is7xx: fix bug in flow control levels init (git-fixes).
- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).
- slab: Decouple slab_debug and no_hash_pointers (bsc#1249022).
- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, boo#1239206).
- smb: client: fix netns refcount leak after net_passive changes (git-fixes).
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (git-fixes).
- soc/tegra: pmc: Ensure power-domains are in a known state (git-fixes).
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (git-fixes).
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (git-fixes).
- soc: qcom: QMI encoding/decoding for big endian (git-fixes).
- soc: qcom: fix endianness for QMI header (git-fixes).
- soc: qcom: mdt_loader: Actually use the e_phoff (stable-fixes).
- soc: qcom: mdt_loader: Deal with zero e_shentsize (git-fixes).
- soc: qcom: mdt_loader: Ensure we do not read past the ELF header (git-fixes).
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (git-fixes).
- soc: qcom: pmic_glink: fix OF node leak (git-fixes).
- soc: qcom: rpmh-rsc: Add RSC version 4 support (stable-fixes).
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (git-fixes).
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (stable-fixes).
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (stable-fixes).
- soundwire: amd: fix for handling slave alerts after link is down (git-fixes).
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (stable-fixes).
- soundwire: stream: restore params when prepare ports fail (git-fixes).
- spi: bcm2835: Remove redundant semicolons (git-fixes).
- spi: cadence-quadspi: Fix cqspi_setup_flash() (git-fixes).
- spi: cadence-quadspi: Flush posted register writes before DAC access (git-fixes).
- spi: cadence-quadspi: Flush posted register writes before INDAC access (git-fixes).
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (stable-fixes).
- spi: cs42l43: Property entry should be a null-terminated array (bsc#1246979).
- spi: fix return code when spi device has too many chipselects (git-fixes).
- spi: mtk-snfi: Remove redundant semicolons (git-fixes).
- spi: spi-fsl-lpspi: Clamp too high speed_hz (git-fixes).
- spi: spi-fsl-lpspi: Clear status register after disabling the module (git-fixes).
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (git-fixes).
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (git-fixes).
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (git-fixes).
- spi: stm32: Check for cfg availability in stm32_spi_probe (git-fixes).
- sprintf.h requires stdarg.h (git-fixes).
- sprintf.h: mask additional include (git-fixes).
- squashfs: fix memory leak in squashfs_fill_super (git-fixes).
- staging: axis-fifo: fix TX handling on copy_from_user() failure (git-fixes).
- staging: axis-fifo: fix maximum TX packet length check (git-fixes).
- staging: axis-fifo: flush RX FIFO on read errors (git-fixes).
- staging: axis-fifo: remove sysfs interface (git-fixes).
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (git-fixes).
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (git-fixes).
- staging: nvec: Fix incorrect null termination of battery manufacturer (git-fixes).
- staging: vchiq_arm: Make vchiq_shutdown never fail (git-fixes).
- struct cdc_ncm_ctx: move new member to end (git-fixes).
- sunrpc: fix client side handling of tls alerts (git-fixes).
- sunrpc: fix handling of server side tls alerts (git-fixes).
- sunrpc: fix null pointer dereference on zero-length checksum (git-fixes).
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (git-fixes).
- supported.conf: Mark ZL3073X modules supported
- supported.conf: mark hyperv_drm as external
- tcp: call tcp_measure_rcv_mss() for ooo packets (git-fixes).
- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (stable-fixes).
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (stable-fixes).
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (stable-fixes).
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (stable-fixes).
- thermal/drivers/qcom/lmh: Add missing IRQ includes (git-fixes).
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (stable-fixes).
- thunderbolt: Compare HMAC values in constant time (git-fixes).
- thunderbolt: Fix copy+paste error in match_service_id() (git-fixes).
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (stable-fixes).
- tools/power turbostat: Fix bogus SysWatt for forked program (git-fixes).
- tools/power turbostat: Fix build with musl (stable-fixes).
- tools/power turbostat: Handle cap_get_proc() ENOSYS (stable-fixes).
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (stable-fixes).
- tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes).
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (git-fixes).
- trace/fgraph: Fix error handling (git-fixes).
- trace/ring-buffer: Do not use TP_printk() formatting for boot mapped buffers (git-fixes).
- tracepoint: Print the function symbol when tracepoint_debug is set (jsc#PED-13631).
- tracing/kprobe: Make trace_kprobe's module callback called after jump_label update (git-fixes).
- tracing/kprobes: Fix to free objects when failed to copy a symbol (git-fixes).
- tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes).
- tracing: Fix filter string testing (git-fixes).
- tracing: Fix using ret variable in tracing_set_tracer() (git-fixes).
- tracing: Remove unneeded goto out logic (bsc#1249286).
- tracing: Switch trace.c code over to use guard() (git-fixes).
- tracing: Switch trace_events_hist.c code over to use guard() (git-fixes).
- tracing: fprobe events: Fix possible UAF on modules (git-fixes).
- tracing: tprobe-events: Fix leakage of module refcount (git-fixes).
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (bsc#1230062).
- tty: n_gsm: Do not block input queue by waiting MSC (git-fixes).
- tty: serial: fix print format specifiers (stable-fixes).
- ublk: sanity check add_dev input for underflow (git-fixes).
- ublk: use vmalloc for ublk_device's __queues (git-fixes).
- ucount: fix atomic_long_inc_below() argument type (git-fixes).
- uio: uio_pdrv_genirq: Remove MODULE_DEVICE_TABLE (git-fixes).
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (git-fixes).
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (git-fixes).
- usb: core: Add 0x prefix to quirks debug output (stable-fixes).
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (stable-fixes).
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (git-fixes).
- usb: core: usb_submit_urb: downgrade type check (stable-fixes).
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (git-fixes).
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (stable-fixes).
- usb: dwc3: imx8mp: fix device leak at unbind (git-fixes).
- usb: dwc3: meson-g12a: fix device leaks at unbind (git-fixes).
- usb: dwc3: pci: add support for the Intel Wildcat Lake (stable-fixes).
- usb: dwc3: qcom: Do not leave BCR asserted (git-fixes).
- usb: early: xhci-dbc: Fix early_ioremap leak (git-fixes).
- usb: gadget : fix use-after-free in composite_dev_cleanup() (git-fixes).
- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (git-fixes).
- usb: gadget: midi2: Fix missing UMP group attributes initialization (git-fixes).
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (git-fixes).
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (git-fixes).
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (git-fixes).
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (git-fixes).
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (git-fixes).
- usb: musb: omap2430: fix device leak at unbind (git-fixes).
- usb: phy: twl6030: Fix incorrect type for ret (git-fixes).
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (stable-fixes).
- usb: renesas-xhci: Fix External ROM access timeouts (git-fixes).
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue (git-fixes).
- usb: typec: fusb302: cache PD RX state (git-fixes).
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (stable-fixes).
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (git-fixes).
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (git-fixes).
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (stable-fixes).
- usb: typec: tcpm: allow switching to mode accessory to mux properly (stable-fixes).
- usb: typec: tcpm: allow to use sink in accessory mode (stable-fixes).
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (git-fixes).
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (git-fixes).
- usb: typec: tipd: Clear interrupts first (git-fixes).
- usb: typec: ucsi: Update power_supply on power role change (git-fixes).
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (stable-fixes).
- usb: typec: ucsi: yoga-c630: fix error and remove paths (git-fixes).
- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).
- usb: xhci: Avoid showing errors during surprise removal (stable-fixes).
- usb: xhci: Avoid showing warnings for dying controller (stable-fixes).
- usb: xhci: Fix slot_id resource race conflict (git-fixes).
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (stable-fixes).
- usb: xhci: print xhci->xhc_state when queue_command failed (stable-fixes).
- use uniform permission checks for all mount propagation changes (git-fixes).
- vdpa/mlx5: Fix needs_teardown flag calculation (git-fixes).
- vdpa: Fix IDR memory leak in VDUSE module exit (git-fixes).
- vhost-scsi: Fix log flooding with target does not exist errors (git-fixes).
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (git-fixes).
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (git-fixes).
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (git-fixes).
- vhost: Reintroduce kthread API and add mode selection (git-fixes).
- vhost: fail early when __vhost_add_used() fails (git-fixes).
- virtchnl2: add flow steering support (jsc#PED-13728).
- virtchnl2: rename enum virtchnl2_cap_rss (jsc#PED-13728).
- virtchnl: add PTP virtchnl definitions (jsc#PED-13728 jsc#PED-13762).
- virtio_net: Enforce minimum TX ring size for reliability (git-fixes).
- virtio_ring: Fix error reporting in virtqueue_resize (git-fixes).
- vmci: Prevent the dispatching of uninitialized payloads (git-fixes).
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (git-fixes).
- vsock/virtio: Validate length in packet header before skb_put() (git-fixes).
- vt: defkeymap: Map keycodes above 127 to K_HOLE (git-fixes).
- vt: keyboard: Do not process Unicode characters in K_OFF mode (git-fixes).
- watchdog: dw_wdt: Fix default timeout (stable-fixes).
- watchdog: iTCO_wdt: Report error if timeout configuration fails (stable-fixes).
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (git-fixes).
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (stable-fixes).
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (git-fixes).
- wifi: ath10k: avoid unnecessary wait for service ready message (git-fixes).
- wifi: ath10k: shutdown driver when hardware is unreliable (stable-fixes).
- wifi: ath11k: HAL SRNG: do not deinitialize and re-initialize again (git-fixes).
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (git-fixes).
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (git-fixes).
- wifi: ath11k: fix dest ring-buffer corruption (git-fixes).
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (git-fixes).
- wifi: ath11k: fix group data packet drops during rekey (git-fixes).
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (git-fixes).
- wifi: ath11k: fix source ring-buffer corruption (git-fixes).
- wifi: ath11k: fix suspend use-after-free after probe failure (git-fixes).
- wifi: ath12k: Add MODULE_FIRMWARE() entries (bsc#1250952).
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (stable-fixes).
- wifi: ath12k: Correct tid cleanup when tid setup fails (stable-fixes).
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (stable-fixes).
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (stable-fixes).
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (stable-fixes).
- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (git-fixes).
- wifi: ath12k: fix dest ring-buffer corruption (git-fixes).
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (git-fixes).
- wifi: ath12k: fix endianness handling while accessing wmi service bit (git-fixes).
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (stable-fixes).
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (git-fixes).
- wifi: ath12k: fix source ring-buffer corruption (git-fixes).
- wifi: ath12k: fix the fetching of combined rssi (git-fixes).
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (git-fixes).
- wifi: ath12k: fix wrong logging ID used for CE (git-fixes).
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (git-fixes).
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (git-fixes).
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (git-fixes).
- wifi: cfg80211: Fix interface type validation (stable-fixes).
- wifi: cfg80211: fix use-after-free in cmp_bss() (git-fixes).
- wifi: cfg80211: reject HTC bit for management frames (stable-fixes).
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (git-fixes).
- wifi: cw1200: cap SSID length in cw1200_do_join() (git-fixes).
- wifi: iwlegacy: Check rate_idx range after addition (stable-fixes).
- wifi: iwlwifi: Add missing firmware info for bz-b0-* models (bsc#1252084).
- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (git-fixes).
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (git-fixes).
- wifi: iwlwifi: Remove redundant header files (git-fixes).
- wifi: iwlwifi: config: unify fw/pnvm MODULE_FIRMWARE (bsc#1252084).
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (stable-fixes).
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (stable-fixes).
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (stable-fixes).
- wifi: iwlwifi: mvm: fix scan request validation (stable-fixes).
- wifi: iwlwifi: mvm: set gtk id also in older FWs (stable-fixes).
- wifi: iwlwifi: return ERR_PTR from opmode start() (stable-fixes).
- wifi: iwlwifi: uefi: check DSM item validity (git-fixes).
- wifi: libertas: cap SSID len in lbs_associate() (git-fixes).
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (git-fixes).
- wifi: mac80211: Do not call fq_flow_idx() for management frames (git-fixes).
- wifi: mac80211: Do not schedule stopped TXQs (git-fixes).
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (git-fixes).
- wifi: mac80211: avoid weird state in error path (stable-fixes).
- wifi: mac80211: do not complete management TX on SAE commit (stable-fixes).
- wifi: mac80211: do not unreserve never reserved chanctx (stable-fixes).
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (git-fixes).
- wifi: mac80211: fix incorrect type for ret (stable-fixes).
- wifi: mac80211: fix rx link assignment for non-MLO stations (stable-fixes).
- wifi: mac80211: increase scan_ies_len for S1G (stable-fixes).
- wifi: mac80211: reject TDLS operations when station is not associated (git-fixes).
- wifi: mac80211: update radar_required in channel context after channel switch (stable-fixes).
- wifi: mt76: fix linked list corruption (git-fixes).
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (git-fixes).
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (git-fixes).
- wifi: mt76: mt7915: fix mt7981 pre-calibration (git-fixes).
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (stable-fixes).
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (git-fixes).
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (git-fixes).
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (git-fixes).
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (git-fixes).
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (git-fixes).
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (git-fixes).
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (git-fixes).
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (git-fixes).
- wifi: mwifiex: Initialize the chan_stats array to zero (git-fixes).
- wifi: mwifiex: send world regulatory domain to driver (git-fixes).
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (git-fixes).
- wifi: plfxlc: Fix error handling in usb driver probe (git-fixes).
- wifi: rtl818x: Kill URBs before clearing tx status queue (git-fixes).
- wifi: rtl8xxxu: Do not claim USB ID 07b8:8188 (stable-fixes).
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (git-fixes).
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (stable-fixes).
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()` (stable-fixes).
- wifi: rtlwifi: rtl8192cu: Do not claim USB ID 07b8:8188 (stable-fixes).
- wifi: rtw88: Fix macid assigned to TDLS station (git-fixes).
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (stable-fixes).
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (stable-fixes).
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (git-fixes).
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (git-fixes).
- wifi: rtw89: scan abort when assign/unassign_vif (stable-fixes).
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (stable-fixes).
- wifi: virt_wifi: Fix page fault on connect (stable-fixes).
- wifi: wilc1000: avoid buffer overflow in WID string configuration (stable-fixes).
- writeback: Avoid contention on wb->list_lock when switching inodes (bsc#1237776).
- writeback: Avoid contention on wb->list_lock when switching inodes (kABI fixup) (bsc#1237776).
- writeback: Avoid excessively long inode switching times (bsc#1237776).
- writeback: Avoid softlockup when switching many inodes (bsc#1237776).
- x86/CPU/AMD: Add CPUID faulting support (jsc#PED-13704).
- x86/Kconfig: Add arch attack vector support (git-fixes).
- x86/Kconfig: Always enable ARCH_SPARSEMEM_ENABLE (git-fixes).
- x86/boot: Sanitize boot params before parsing command line (git-fixes).
- x86/bugs: Add SRSO_MITIGATION_NOSMT (git-fixes).
- x86/bugs: Add attack vector controls for BHI (git-fixes).
- x86/bugs: Add attack vector controls for GDS (git-fixes).
- x86/bugs: Add attack vector controls for ITS (git-fixes).
- x86/bugs: Add attack vector controls for L1TF (git-fixes).
- x86/bugs: Add attack vector controls for MDS (git-fixes).
- x86/bugs: Add attack vector controls for MMIO (git-fixes).
- x86/bugs: Add attack vector controls for RFDS (git-fixes).
- x86/bugs: Add attack vector controls for SRBDS (git-fixes).
- x86/bugs: Add attack vector controls for SRSO (git-fixes).
- x86/bugs: Add attack vector controls for SSB (git-fixes).
- x86/bugs: Add attack vector controls for TAA (git-fixes).
- x86/bugs: Add attack vector controls for TSA (git-fixes).
- x86/bugs: Add attack vector controls for retbleed (git-fixes).
- x86/bugs: Add attack vector controls for spectre_v1 (git-fixes).
- x86/bugs: Add attack vector controls for spectre_v2 (git-fixes).
- x86/bugs: Add attack vector controls for spectre_v2_user (git-fixes).
- x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also (git-fixes).
- x86/bugs: Avoid AUTO after the select step in the retbleed mitigation (git-fixes).
- x86/bugs: Avoid warning when overriding return thunk (git-fixes).
- x86/bugs: Clean up SRSO microcode handling (git-fixes).
- x86/bugs: Define attack vectors relevant for each bug (git-fixes).
- x86/bugs: Fix GDS mitigation selecting when mitigation is off (git-fixes).
- x86/bugs: Introduce cdt_possible() (git-fixes).
- x86/bugs: Print enabled attack vectors (git-fixes).
- x86/bugs: Remove its=stuff dependency on retbleed (git-fixes).
- x86/bugs: Select best SRSO mitigation (git-fixes).
- x86/bugs: Simplify the retbleed=stuff checks (git-fixes).
- x86/bugs: Use IBPB for retbleed if used by SRSO (git-fixes).
- x86/bugs: Use switch/case in its_apply_mitigation() (git-fixes).
- x86/cacheinfo: Properly parse CPUID(0x80000005) L1d/L1i associativity (git-fixes).
- x86/cacheinfo: Properly parse CPUID(0x80000006) L2/L3 associativity (git-fixes).
- x86/cpu: Sanitize CPUID(0x80000000) output (git-fixes).
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (git-fixes).
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (git-fixes).
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (git-fixes).
- x86/fpu: Delay instruction pointer fixup until after warning (git-fixes).
- x86/fpu: Fix guest FPU state buffer allocation size (git-fixes).
- x86/fpu: Fully optimize out WARN_ON_FPU() (git-fixes).
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (git-fixes).
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (git-fixes).
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (git-fixes).
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (git-fixes).
- x86/mce/amd: Add default names for MCA banks and blocks (git-fixes).
- x86/mce: Do not remove sysfs if thresholding sysfs init fails (git-fixes).
- x86/mce: Ensure user polling settings are honored when restarting timer (git-fixes).
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (git-fixes).
- x86/microcode/AMD: Handle the case of no BIOS microcode (git-fixes).
- x86/microcode: Consolidate the loader enablement checking (git-fixes).
- x86/microcode: Update the Intel processor flag scan check (git-fixes).
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (git-fixes).
- x86/mm/pat: do not collapse pages without PSE set (git-fixes).
- x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (git-fixes).
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 (git-fixes).
- x86/pkeys: Simplify PKRU update in signal frame (git-fixes).
- x86/platform/olpc: Remove unused variable 'len' in olpc_dt_compatible_match() (git-fixes).
- x86/pti: Add attack vector controls for PTI (git-fixes).
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (git-fixes).
- x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).
- x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).
- x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (git-fixes).
- x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).
- x86/traps: Initialize DR6 by writing its architectural reset value (git-fixes).
- xen/gntdev: remove struct gntdev_copy_batch from stack (git-fixes).
- xen/netfront: Fix TX response spurious interrupts (git-fixes).
- xen: fix UAF in dmabuf_exp_from_pages() (git-fixes).
- xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO (git-fixes).
- xfs: change xfs_xattr_class from a TRACE_EVENT() to DECLARE_EVENT_CLASS() (git-fixes).
- xfs: do not propagate ENODATA disk errors into xattr code (git-fixes).
- xfs: fix scrub trace with null pointer in quotacheck (git-fixes).
- xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT is configure (git-fixes).
- xfs: remove unused event xfs_alloc_near_error (git-fixes).
- xfs: remove unused event xfs_alloc_near_nominleft (git-fixes).
- xfs: remove unused event xfs_attr_node_removename (git-fixes).
- xfs: remove unused event xfs_ioctl_clone (git-fixes).
- xfs: remove unused event xfs_pagecache_inval (git-fixes).
- xfs: remove unused event xlog_iclog_want_sync (git-fixes).
- xfs: remove unused trace event xfs_attr_remove_iter_return (git-fixes).
- xfs: remove unused trace event xfs_attr_rmtval_set (git-fixes).
- xfs: remove unused trace event xfs_discard_rtrelax (git-fixes).
- xfs: remove unused trace event xfs_log_cil_return (git-fixes).
- xfs: remove unused trace event xfs_reflink_cow_enospc (git-fixes).
- xfs: remove unused xfs_attr events (git-fixes).
- xfs: remove unused xfs_reflink_compare_extents events (git-fixes).
- xfs: remove usused xfs_end_io_direct events (git-fixes).
- xhci: dbc: Fix full DbC transfer ring after several reconnects (git-fixes).
- xhci: dbc: decouple endpoint allocation from initialization (git-fixes).
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (git-fixes).
- xirc2ps_cs: fix register access when enabling FullDuplex (git-fixes).
- zram: permit only one post-processing operation at a time (git-fixes).
-----------------------------------------------------------------
Advisory ID: 58
Released: Wed Nov 26 18:04:24 2025
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1218644,1238472,1239206,1241166,1241637,1247222,1248630,1249161,1249226,1249302,1249317,1249397,1249398,1249495,1249512,1249608,1249735,1250202,1250379,1250400,1250455,1250491,1250704,1250721,1250749,1250946,1251176,1251177,1251232,1251233,1251804,1251809,1251819,1251930,1251967,1252033,1252035,1252039,1252044,1252047,1252051,1252052,1252056,1252060,1252062,1252064,1252065,1252067,1252069,1252070,1252072,1252074,1252075,1252076,1252078,1252079,1252081,1252082,1252083,1252253,1252265,1252267,1252270,1252330,1252333,1252336,1252346,1252348,1252349,1252678,1252679,1252688,1252725,1252734,1252772,1252774,1252780,1252785,1252787,1252789,1252797,1252819,1252822,1252826,1252841,1252848,1252849,1252850,1252851,1252854,1252858,1252862,1252865,1252866,1252873,1252902,1252909,1252915,1252918,1252921,1252939,CVE-2025-21816,CVE-2025-38653,CVE-2025-38718,CVE-2025-39676,CVE-2025-39702,CVE-2025-39756,CVE-2025-39779,CVE-2025-39797,CVE-2025-39812,CVE-2025-39866,CVE-2025-39876,CVE-2025-398
81,CVE-2025-39895,CVE-2025-39903,CVE-2025-39911,CVE-2025-39947,CVE-2025-39948,CVE-2025-39949,CVE-2025-39950,CVE-2025-39955,CVE-2025-39956,CVE-2025-39963,CVE-2025-39965,CVE-2025-39967,CVE-2025-39968,CVE-2025-39969,CVE-2025-39970,CVE-2025-39971,CVE-2025-39972,CVE-2025-39973,CVE-2025-39978,CVE-2025-39979,CVE-2025-39981,CVE-2025-39982,CVE-2025-39984,CVE-2025-39985,CVE-2025-39986,CVE-2025-39987,CVE-2025-39988,CVE-2025-39991,CVE-2025-39992,CVE-2025-39993,CVE-2025-39994,CVE-2025-39995,CVE-2025-39996,CVE-2025-39997,CVE-2025-40000,CVE-2025-40005,CVE-2025-40009,CVE-2025-40011,CVE-2025-40012,CVE-2025-40013,CVE-2025-40016,CVE-2025-40018,CVE-2025-40019,CVE-2025-40020,CVE-2025-40029,CVE-2025-40032,CVE-2025-40035,CVE-2025-40036,CVE-2025-40037,CVE-2025-40040,CVE-2025-40043,CVE-2025-40044,CVE-2025-40048,CVE-2025-40049,CVE-2025-40051,CVE-2025-40052,CVE-2025-40056,CVE-2025-40058,CVE-2025-40060,CVE-2025-40061,CVE-2025-40062,CVE-2025-40071,CVE-2025-40078,CVE-2025-40080,CVE-2025-40085,CVE-2025-40087,CVE-
2025-40091,CVE-2025-40096,CVE-2025-40100,CVE-2025-40104,CVE-2025-40364
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).
- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).
- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).
- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).
- CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).
- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).
- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).
- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).
- CVE-2025-39984: net: tun: Update napi->skb after XDP process (bsc#1252081).
- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).
- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).
- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).
- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).
- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).
- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).
- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).
- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).
- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).
The following non security issues were fixed:
- add bug reference to existing hv_netvsc change (bsc#1252265)
- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).
- cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (bsc#1241166).
- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).
- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).
- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT
The character was previously 'N', but upstream used it for TAINT_TEST,
which prompted the change of TAINT_NO_SUPPORT to 'n'.
- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).
- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).
- dpll: zl3073x: Add low-level flash functions (bsc#1252253).
- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).
- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).
- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).
- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).
- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).
- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).
- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).
- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).
- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).
- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).
- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).
- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).
- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).
- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).
- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).
- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).
- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).
- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).
- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)
- proc: fix type confusion in pde_set_flags() (bsc#1248630)
- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).
- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).
-----------------------------------------------------------------
Advisory ID: 106
Released: Mon Dec 15 13:52:50 2025
Summary: Security update for grub2
Type: security
Severity: important
References: 1234959,1245636,1245738,1245953,1246231,1247242,1249088,1249385,1252930,1252931,1252932,1252933,1252934,1252935,CVE-2024-56738,CVE-2025-54770,CVE-2025-54771,CVE-2025-61661,CVE-2025-61662,CVE-2025-61663,CVE-2025-61664
This update for grub2 fixes the following issues:
Changes in grub2:
- CVE-2025-54771: Fixed grub_file_close() does not properly controls the fs refcount (bsc#1252931)
- CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free (bsc#1252930)
- CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free (bsc#1252933)
- CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free (bsc#1252934)
- CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free (bsc#1252935)
- CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)
- Bump upstream SBAT generation to 6
- Fix 'sparse file not allowed' error after grub2-reboot (bsc#1245738)
- Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
- turn off page flipping for i386-pc using VBE video backend (bsc#1245636)
- Fix boot hangs in setting up serial console when ACPI SPCR table is present
and redirection is disabled (bsc#1249088)
- Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
- Skip mount point in grub_find_device function (bsc#1246231)
- CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp (bsc#1234959)
-----------------------------------------------------------------
Advisory ID: 107
Released: Mon Dec 15 19:16:15 2025
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1250232,1250233,1250234,CVE-2025-9230,CVE-2025-9231,CVE-2025-9232
This update for openssl-3 fixes the following issues:
- CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
- CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
- CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
-----------------------------------------------------------------
Advisory ID: 109
Released: Tue Dec 16 15:14:02 2025
Summary: Recommended update for freetype2
Type: recommended
Severity: moderate
References:
This update for freetype2 fixes the following issues:
Changes in freetype2:
- update to 2.13.3:
- Do not build the ft2demos flavor in SLE16 where Qt5 will not be
available
-----------------------------------------------------------------
Advisory ID: 113
Released: Fri Dec 19 18:38:16 2025
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1235463,1243474,1245193,1245431,1245498,1245499,1246328,1246843,1247500,1248792,1249256,1249397,1249912,1249977,1249982,1250034,1250176,1250237,1250252,1250705,1250723,1250746,1251120,1251817,1252054,1252063,1252301,1252303,1252342,1252352,1252357,1252681,1252686,1252763,1252776,1252779,1252790,1252794,1252795,1252808,1252809,1252817,1252821,1252824,1252836,1252845,1252901,1252912,1252917,1252919,1252923,1252928,1253018,1253155,1253176,1253238,1253275,1253318,1253324,1253328,1253330,1253342,1253348,1253349,1253352,1253355,1253360,1253362,1253363,1253367,1253369,1253386,1253394,1253395,1253402,1253403,1253405,1253407,1253408,1253409,1253410,1253412,1253416,1253421,1253422,1253423,1253424,1253425,1253426,1253427,1253428,1253431,1253433,1253436,1253438,1253440,1253441,1253443,1253445,1253448,1253449,1253450,1253451,1253453,1253455,1253456,1253457,1253463,1253472,1253622,1253624,1253635,1253643,1253647,1254119,1254181,1254221,1254308,1254315,CVE-2022-50253,CVE-2025-37916,CVE
-2025-38084,CVE-2025-38085,CVE-2025-38321,CVE-2025-38728,CVE-2025-39805,CVE-2025-39819,CVE-2025-39822,CVE-2025-39831,CVE-2025-39859,CVE-2025-39897,CVE-2025-39917,CVE-2025-39944,CVE-2025-39961,CVE-2025-39980,CVE-2025-39990,CVE-2025-40001,CVE-2025-40003,CVE-2025-40006,CVE-2025-40021,CVE-2025-40024,CVE-2025-40027,CVE-2025-40031,CVE-2025-40033,CVE-2025-40038,CVE-2025-40047,CVE-2025-40053,CVE-2025-40055,CVE-2025-40059,CVE-2025-40064,CVE-2025-40070,CVE-2025-40074,CVE-2025-40075,CVE-2025-40081,CVE-2025-40083,CVE-2025-40086,CVE-2025-40098,CVE-2025-40101,CVE-2025-40102,CVE-2025-40105,CVE-2025-40107,CVE-2025-40109,CVE-2025-40110,CVE-2025-40111,CVE-2025-40115,CVE-2025-40116,CVE-2025-40118,CVE-2025-40120,CVE-2025-40121,CVE-2025-40127,CVE-2025-40129,CVE-2025-40132,CVE-2025-40133,CVE-2025-40134,CVE-2025-40135,CVE-2025-40139,CVE-2025-40140,CVE-2025-40141,CVE-2025-40142,CVE-2025-40149,CVE-2025-40153,CVE-2025-40154,CVE-2025-40156,CVE-2025-40157,CVE-2025-40158,CVE-2025-40159,CVE-2025-40161,CVE-2025-4
0162,CVE-2025-40164,CVE-2025-40165,CVE-2025-40166,CVE-2025-40168,CVE-2025-40169,CVE-2025-40171,CVE-2025-40172,CVE-2025-40173,CVE-2025-40175,CVE-2025-40176,CVE-2025-40177,CVE-2025-40178,CVE-2025-40180,CVE-2025-40183,CVE-2025-40185,CVE-2025-40186,CVE-2025-40187,CVE-2025-40188,CVE-2025-40192,CVE-2025-40194,CVE-2025-40196,CVE-2025-40197,CVE-2025-40198,CVE-2025-40200,CVE-2025-40201,CVE-2025-40202,CVE-2025-40203,CVE-2025-40204,CVE-2025-40205,CVE-2025-40206,CVE-2025-40207
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
- CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
- CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
- CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
- CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
- CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
- CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
- CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
- CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
- CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
- CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
- CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
- CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
- CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
- CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
- CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
- CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
- CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
- CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
- CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
- CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
- CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
- CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
- CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
- CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
- CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
- CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
- CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
- CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
- CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
- CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
- CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
- CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
- CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
- CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
- CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
- CVE-2025-40157: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (bsc#1253423).
- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
- CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
- CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
- CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
- CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
- CVE-2025-40175: idpf: cleanup remaining SKBs in PTP flows (bsc#1253426).
- CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
- CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
- CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
- CVE-2025-40203: listmount: don't call path_put() under namespace semaphore (bsc#1253457).
The following non security issues were fixed:
- ACPI: scan: Update honor list for RPMI System MSI (stable-fixes).
- ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).
- Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a
proper watchdog interface and has many code issues. It only handles
obscure and obsolete hardware. Stop building and supporting this driver
(jsc#PED-14062).
- Fix 'drm/xe: Don't allow evicting of BOs in same VM in array of VM binds' (bsc#1252923)
- KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).
- KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).
- KVM: s390: improve interrupt cpu for wakeup (bsc#1235463).
- KVM: s390: kABI backport for 'last_sleep_cpu' (bsc#1252352).
- KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault (git-fixes).
- PCI/ERR: Update device error_state already after reset (stable-fixes).
- PM: EM: Slightly reduce em_check_capacity_update() overhead (stable-fixes).
- Revert 'net/mlx5e: Update and set Xon/Xoff upon MTU set' (git-fixes).
- Revert 'net/mlx5e: Update and set Xon/Xoff upon port speed set' (git-fixes).
- Update config files: enable zstd module decompression (jsc#PED-14115).
- bpf/selftests: Fix test_tcpnotify_user (bsc#1253635).
- btrfs: do not clear read-only when adding sprout device (bsc#1253238).
- btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).
- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).
- drm/amd/display: update color on atomic commit time (stable-fixes).
- drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).
- hwmon: (lenovo-ec-sensors) Update P8 supprt (stable-fixes).
- media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).
- mount: handle NULL values in mnt_ns_release() (bsc#1254308)
- net/smc: Remove validation of reserved bits in CLC Decline (bsc#1252357).
- net: phy: move realtek PHY driver to its own subdirectory (jsc#PED-14353).
- net: phy: realtek: add defines for shadowed c45 standard registers (jsc#PED-14353).
- net: phy: realtek: add helper RTL822X_VND2_C22_REG (jsc#PED-14353).
- net: phy: realtek: change order of calls in C22 read_status() (jsc#PED-14353).
- net: phy: realtek: clear 1000Base-T link partner advertisement (jsc#PED-14353).
- net: phy: realtek: improve mmd register access for internal PHY's (jsc#PED-14353).
- net: phy: realtek: read duplex and gbit master from PHYSR register (jsc#PED-14353).
- net: phy: realtek: switch from paged to MMD ops in rtl822x functions (jsc#PED-14353).
- net: phy: realtek: use string choices helpers (jsc#PED-14353).
- net: xilinx: axienet: Fix IRQ coalescing packet count overflow (bsc#1250746)
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (bsc#1250746)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (bsc#1250746)
- nvmet-auth: update sc_c in host response (git-fixes bsc#1249397).
- nvmet-auth: update sc_c in target host hash calculation (git-fixes).
- perf list: Add IBM z17 event descriptions (jsc#PED-13611).
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (git-fixes).
- powercap: intel_rapl: Add support for Panther Lake platform (jsc#PED-13949).
- pwm: pca9685: Use bulk write to atomicially update registers (stable-fixes).
- r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers (jsc#PED-14353).
- r8169: add support for Intel Killer E5000 (jsc#PED-14353).
- r8169: add support for RTL8125BP rev.b (jsc#PED-14353).
- r8169: add support for RTL8125D rev.b (jsc#PED-14353).
- r8169: adjust version numbering for RTL8126 (jsc#PED-14353).
- r8169: align RTL8125 EEE config with vendor driver (jsc#PED-14353).
- r8169: align RTL8125/RTL8126 PHY config with vendor driver (jsc#PED-14353).
- r8169: align RTL8126 EEE config with vendor driver (jsc#PED-14353).
- r8169: align WAKE_PHY handling with r8125/r8126 vendor drivers (jsc#PED-14353).
- r8169: avoid duplicated messages if loading firmware fails and switch to warn level (jsc#PED-14353).
- r8169: don't take RTNL lock in rtl_task() (jsc#PED-14353).
- r8169: enable EEE at 2.5G per default on RTL8125B (jsc#PED-14353).
- r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (jsc#PED-14353).
- r8169: fix inconsistent indenting in rtl8169_get_eth_mac_stats (jsc#PED-14353).
- r8169: implement additional ethtool stats ops (jsc#PED-14353).
- r8169: improve __rtl8169_set_wol (jsc#PED-14353).
- r8169: improve initialization of RSS registers on RTL8125/RTL8126 (jsc#PED-14353).
- r8169: improve rtl_set_d3_pll_down (jsc#PED-14353).
- r8169: increase max jumbo packet size on RTL8125/RTL8126 (jsc#PED-14353).
- r8169: remove leftover locks after reverted change (jsc#PED-14353).
- r8169: remove original workaround for RTL8125 broken rx issue (jsc#PED-14353).
- r8169: remove rtl_dash_loop_wait_high/low (jsc#PED-14353).
- r8169: remove support for chip version 11 (jsc#PED-14353).
- r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE (jsc#PED-14353).
- r8169: replace custom flag with disable_work() et al (jsc#PED-14353).
- r8169: switch away from deprecated pcim_iomap_table (jsc#PED-14353).
- r8169: use helper r8169_mod_reg8_cond to simplify rtl_jumbo_config (jsc#PED-14353).
- ring-buffer: Update pages_touched to reflect persistent buffer content (git-fixes).
- s390/mm: Fix __ptep_rdp() inline assembly (bsc#1253643).
- sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() (bsc#1246843).
- sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1248792).
- sched/fair: Proportional newidle balance (bsc#1248792).
- sched/fair: Proportional newidle balance -KABI (bsc#1248792).
- sched/fair: Revert max_newidle_lb_cost bump (bsc#1248792).
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1248792).
- sched/fair: Small cleanup to sched_balance_newidle() (bsc#1248792).
- sched/fair: Small cleanup to update_newidle_cost() (bsc#1248792).
- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).
- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).
- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).
- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).
- selftests/run_kselftest.sh: Add `--skip` argument option (bsc#1254221).
- smpboot: introduce SDTL_INIT() helper to tidy sched topology setup (bsc#1246843).
- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).
- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)
- spi: tegra210-quad: Fix timeout handling (bsc#1253155)
- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)
- spi: tegra210-quad: Update dummy sequence configuration (git-fixes)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork (bsc#1250705).
- wifi: ath11k: Add quirk entries for Thinkpad T14s Gen3 AMD (bsc#1254181).
- wifi: mt76: do not add wcid entries to sta poll list during MCU reset (bsc#1254315).
- wifi: mt76: introduce mt792x_config_mac_addr_list routine (bsc#1254315).
- wifi: mt76: mt7925: Fix logical vs bitwise typo (bsc#1254315).
- wifi: mt76: mt7925: Remove unnecessary if-check (bsc#1254315).
- wifi: mt76: mt7925: Simplify HIF suspend handling to avoid suspend fail (bsc#1254315).
- wifi: mt76: mt7925: add EHT control support based on the CLC data (bsc#1254315).
- wifi: mt76: mt7925: add handler to hif suspend/resume event (bsc#1254315).
- wifi: mt76: mt7925: add pci restore for hibernate (bsc#1254315).
- wifi: mt76: mt7925: config the dwell time by firmware (bsc#1254315).
- wifi: mt76: mt7925: extend MCU support for testmode (bsc#1254315).
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (bsc#1254315).
- wifi: mt76: mt7925: fix missing hdr_trans_tlv command for broadcast wtbl (bsc#1254315).
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (bsc#1254315).
- wifi: mt76: mt7925: refine the txpower initialization flow (bsc#1254315).
- wifi: mt76: mt7925: replace zero-length array with flexible-array member (bsc#1254315).
- wifi: mt76: mt7925: update the channel usage when the regd domain changed (bsc#1254315).
- wifi: mt76: mt7925e: fix too long of wifi resume time (bsc#1254315).
- x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled (bsc#1246843).
- x86/smpboot: moves x86_topology to static initialize and truncate (bsc#1246843).
- x86/smpboot: remove redundant CONFIG_SCHED_SMT (bsc#1246843).
-----------------------------------------------------------------
Advisory ID: 131
Released: Mon Jan 12 12:14:46 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1254157,1254158,1254159,1254160,1254480,CVE-2025-64505,CVE-2025-64506,CVE-2025-64720,CVE-2025-65018,CVE-2025-66293
This update for libpng16 fixes the following issues:
- CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices
(bsc#1254157).
- CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit`
enabled (bsc#1254158).
- CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with
`PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159).
- CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced
PNGs with 8-bit output format (bsc#1254160).
- CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial
transparency and gamma correction (bsc#1254480).
-----------------------------------------------------------------
Advisory ID: 162
Released: Thu Jan 22 09:15:08 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1250655,1250664,1253679,1254264,1254928
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.64:
* udev rules: write block queue attributes only if necessary (bsc#1254928)
- Update to version 16.0.63:
* 80-hotplug-cpu-mem.rules: remount tmpfs on 'online' uevents (bsc#1254264)
* udev: use systemd service to remount tmpfs (bsc#1253679)
- Update to version 16.0.62:
* spec file: remove %udev_rules_update call (bsc#1250664)
- Update to version 16.0.61:
* weak-modules2: skip livepatch dir when checking for unresolved symbols (bsc#1250655)
-----------------------------------------------------------------
Advisory ID: 172
Released: Thu Jan 22 15:29:42 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1256525,1256526,CVE-2026-22695,CVE-2026-22801
This update for libpng16 fixes the following issues:
- CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
- CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).
-----------------------------------------------------------------
Advisory ID: 206
Released: Wed Jan 28 12:26:08 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1248516
This update for grub2 fixes the following issues:
- Optimize PBKDF2 to reduce the decryption time (bsc#1248516)
* lib/crypto: Introduce new HMAC functions to reuse buffers
* lib/pbkdf2: Optimize PBKDF2 by reusing HMAC handle
* kern/misc: Implement faster grub_memcpy() for aligned buffers
-----------------------------------------------------------------
Advisory ID: 218
Released: Thu Jan 29 18:44:57 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1236282,1256436,1256766,1256822,1257005,CVE-2025-0395,CVE-2025-15281,CVE-2026-0861,CVE-2026-0915
This update for glibc fixes the following issues:
Security fixes:
- CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
- CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
- CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
- CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).
Other fixes:
- NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)
-----------------------------------------------------------------
Advisory ID: 230
Released: Mon Feb 2 12:54:26 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1205462,1214285,1243112,1245193,1247500,1250388,1252046,1252861,1253155,1253238,1253262,1253365,1253400,1253413,1253414,1253442,1253458,1253623,1253674,1253739,1254126,1254128,1254195,1254244,1254363,1254378,1254408,1254477,1254510,1254518,1254519,1254520,1254615,1254616,1254618,1254621,1254624,1254791,1254793,1254794,1254795,1254796,1254797,1254798,1254808,1254809,1254813,1254815,1254821,1254824,1254825,1254827,1254828,1254829,1254830,1254832,1254835,1254840,1254843,1254846,1254847,1254849,1254850,1254851,1254852,1254854,1254856,1254858,1254860,1254861,1254864,1254868,1254869,1254871,1254894,1254957,1254959,1254961,1254964,1254996,1255026,1255030,1255034,1255035,1255039,1255040,1255041,1255042,1255057,1255058,1255064,1255065,1255068,1255071,1255072,1255075,1255077,1255081,1255082,1255083,1255087,1255092,1255094,1255095,1255097,1255099,1255103,1255116,1255120,1255121,1255122,1255124,1255131,1255134,1255135,1255136,1255138,1255140,1255142,1255145,1255146,1255149,1255150,1
255152,1255154,1255155,1255156,1255161,1255167,1255169,1255171,1255175,1255179,1255181,1255182,1255186,1255187,1255190,1255193,1255196,1255197,1255199,1255202,1255203,1255206,1255209,1255218,1255220,1255221,1255223,1255226,1255227,1255228,1255230,1255231,1255233,1255234,1255242,1255243,1255246,1255247,1255251,1255252,1255253,1255255,1255256,1255259,1255260,1255261,1255262,1255272,1255273,1255274,1255276,1255279,1255297,1255312,1255316,1255318,1255325,1255329,1255346,1255349,1255351,1255354,1255357,1255377,1255379,1255380,1255395,1255401,1255415,1255428,1255433,1255434,1255480,1255483,1255488,1255489,1255493,1255495,1255505,1255507,1255508,1255509,1255533,1255541,1255550,1255552,1255553,1255567,1255580,1255601,1255603,1255611,1255614,1255672,1255688,1255698,1255706,1255707,1255709,1255722,1255723,1255724,1255812,1255813,1255814,1255816,1255931,1255932,1255934,1255943,1255944,1256238,1256495,1256606,1256794,CVE-2025-38704,CVE-2025-39880,CVE-2025-39977,CVE-2025-40042,CVE-2025-40123,CVE
-2025-40130,CVE-2025-40160,CVE-2025-40167,CVE-2025-40170,CVE-2025-40179,CVE-2025-40190,CVE-2025-40209,CVE-2025-40211,CVE-2025-40212,CVE-2025-40213,CVE-2025-40214,CVE-2025-40215,CVE-2025-40218,CVE-2025-40219,CVE-2025-40220,CVE-2025-40221,CVE-2025-40223,CVE-2025-40225,CVE-2025-40226,CVE-2025-40231,CVE-2025-40233,CVE-2025-40235,CVE-2025-40237,CVE-2025-40238,CVE-2025-40239,CVE-2025-40240,CVE-2025-40242,CVE-2025-40246,CVE-2025-40248,CVE-2025-40250,CVE-2025-40251,CVE-2025-40252,CVE-2025-40254,CVE-2025-40255,CVE-2025-40256,CVE-2025-40258,CVE-2025-40262,CVE-2025-40263,CVE-2025-40264,CVE-2025-40266,CVE-2025-40268,CVE-2025-40269,CVE-2025-40271,CVE-2025-40272,CVE-2025-40273,CVE-2025-40274,CVE-2025-40275,CVE-2025-40276,CVE-2025-40277,CVE-2025-40278,CVE-2025-40279,CVE-2025-40280,CVE-2025-40282,CVE-2025-40283,CVE-2025-40284,CVE-2025-40287,CVE-2025-40288,CVE-2025-40289,CVE-2025-40292,CVE-2025-40293,CVE-2025-40294,CVE-2025-40297,CVE-2025-40301,CVE-2025-40302,CVE-2025-40303,CVE-2025-40304,CVE-2025-4
0307,CVE-2025-40308,CVE-2025-40309,CVE-2025-40310,CVE-2025-40311,CVE-2025-40314,CVE-2025-40315,CVE-2025-40316,CVE-2025-40317,CVE-2025-40318,CVE-2025-40319,CVE-2025-40320,CVE-2025-40321,CVE-2025-40322,CVE-2025-40323,CVE-2025-40324,CVE-2025-40328,CVE-2025-40329,CVE-2025-40330,CVE-2025-40331,CVE-2025-40332,CVE-2025-40337,CVE-2025-40338,CVE-2025-40339,CVE-2025-40340,CVE-2025-40342,CVE-2025-40343,CVE-2025-40344,CVE-2025-40345,CVE-2025-40346,CVE-2025-40347,CVE-2025-40350,CVE-2025-40353,CVE-2025-40354,CVE-2025-40355,CVE-2025-40357,CVE-2025-40359,CVE-2025-40360,CVE-2025-40362,CVE-2025-68167,CVE-2025-68170,CVE-2025-68171,CVE-2025-68172,CVE-2025-68176,CVE-2025-68180,CVE-2025-68181,CVE-2025-68183,CVE-2025-68184,CVE-2025-68185,CVE-2025-68190,CVE-2025-68192,CVE-2025-68194,CVE-2025-68195,CVE-2025-68197,CVE-2025-68198,CVE-2025-68201,CVE-2025-68202,CVE-2025-68206,CVE-2025-68207,CVE-2025-68208,CVE-2025-68209,CVE-2025-68210,CVE-2025-68213,CVE-2025-68215,CVE-2025-68217,CVE-2025-68222,CVE-2025-68223,CV
E-2025-68230,CVE-2025-68233,CVE-2025-68235,CVE-2025-68237,CVE-2025-68238,CVE-2025-68239,CVE-2025-68242,CVE-2025-68244,CVE-2025-68249,CVE-2025-68252,CVE-2025-68254,CVE-2025-68255,CVE-2025-68256,CVE-2025-68257,CVE-2025-68258,CVE-2025-68259,CVE-2025-68264,CVE-2025-68283,CVE-2025-68284,CVE-2025-68285,CVE-2025-68286,CVE-2025-68287,CVE-2025-68289,CVE-2025-68290,CVE-2025-68293,CVE-2025-68298,CVE-2025-68301,CVE-2025-68302,CVE-2025-68303,CVE-2025-68305,CVE-2025-68306,CVE-2025-68307,CVE-2025-68308,CVE-2025-68311,CVE-2025-68312,CVE-2025-68313,CVE-2025-68317,CVE-2025-68327,CVE-2025-68328,CVE-2025-68330,CVE-2025-68331,CVE-2025-68332,CVE-2025-68335,CVE-2025-68339,CVE-2025-68340,CVE-2025-68342,CVE-2025-68343,CVE-2025-68344,CVE-2025-68345,CVE-2025-68346,CVE-2025-68347,CVE-2025-68351,CVE-2025-68352,CVE-2025-68353,CVE-2025-68354,CVE-2025-68362,CVE-2025-68363,CVE-2025-68378,CVE-2025-68380,CVE-2025-68724,CVE-2025-68732,CVE-2025-68736,CVE-2025-68740,CVE-2025-68742,CVE-2025-68744,CVE-2025-68746,CVE-2025-
68747,CVE-2025-68748,CVE-2025-68749,CVE-2025-68750,CVE-2025-68753,CVE-2025-68757,CVE-2025-68758,CVE-2025-68759,CVE-2025-68765,CVE-2025-68766,CVE-2025-71096
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
- CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
- CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
- CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
- CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
- CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
- CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
- CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
- CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
- CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in
qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
- CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
- CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
- CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
- CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
- CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
- CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
- CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
- CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
- CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
- CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).
- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
- CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).
- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
- CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
- CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
- CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
- CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
- CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
- CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
- CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
- CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).
The following non security issues were fixed:
- KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
- Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
- btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
- cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
- cifs: update dstaddr whenever channel iface is updated (git-fixes).
- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
- cpuset: fix warning when disabling remote partition (bsc#1256794).
- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
- netdevsim: print human readable IP address (bsc#1255071).
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event
handling (bsc#1253262 ltc#216029).
- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285
bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493
bsc#1254244 ltc#216496).
- sched: Increase sched_tick_remote timeout (bsc#1254510).
- selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
- selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
- selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
- supported.conf: Mark lan 743x supported (jsc#PED-14571)
- tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
- x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
- x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
- x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).
-----------------------------------------------------------------
Advisory ID: 237
Released: Mon Feb 2 14:00:02 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1256829,1256830,1256831,1256832,1256833,1256834,1256835,1256836,1256837,1256838,1256839,1256840,1257274,CVE-2025-11187,CVE-2025-15467,CVE-2025-15468,CVE-2025-15469,CVE-2025-66199,CVE-2025-68160,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796
This update for openssl-3 fixes the following issues:
Security fixes:
- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
- CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs >16MB (bsc#1256832).
- CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
- CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
- CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
- CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
- CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
- CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
- CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
- CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).
Other fixes:
- Enable livepatching support for ppc64le (bsc#1257274).
-----------------------------------------------------------------
Advisory ID: 244
Released: Thu Feb 5 12:26:20 2026
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1256805,CVE-2026-0989
This update for libxml2 fixes the following issues:
- CVE-2026-0989: Fixed call stack exhaustion leading to application crash
due to RelaxNG parser not limiting the recursion depth when
resolving `<include>` directives (bsc#1256805).
-----------------------------------------------------------------
Advisory ID: 252
Released: Wed Feb 11 12:13:17 2026
Summary: Recommended update for systemd
Type: recommended
Severity: important
References: 1228081,1228659,1228728,1231986,1234765,1244449,1248356,1248501,1251981,1254563,1255326,1256427
This update for systemd fixes the following issues:
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
- core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
- Name libsystemd-{shared,core} based on the major version of systemd and the
package release number (bsc#1228081, bsc#1256427)
- systemd-update-helper: clean up the flags immediately after they have been consumed.
- systemd.spec: don't reexecute PID1 on transactional updates.
- Drop most of the workarounds contained in the fixlets.
- Drop %filetriggers build flag. It was introduced to ease backport of Base:System to SLE distros
where file-triggers were unreliable but that is no longer the case on the latest SLE distros.
- Fix: systemd Tainted: unmerged-bin (bsc#1228728, bsc#1251981)
- timer: rebase last_trigger timestamp if needed
- timer: rebase the next elapse timestamp only if timer didn't already run
- main: switch explicitly to tty1 on soft-reboot (bsc#1231986)
- terminal-util: modernize vtnr_from_tty() a bit
- units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
- systemd.spec: use %sysusers_generate_pre so that some systemd users are
already available in %pre (bsc#1248501)
- core/cgroup: Properly handle aborting a pending freeze operation
- detect-virt: add bare-metal support for GCE (bsc#1244449)
- uki.conf is used by the ukify tool to create an Unified Kernel Image[...]
- Make sure that the ordering trick used to update the udev package as close as
as possible to the update of the systemd package also works with zypper.
- Fix: Snapshot 20240730 - unbootable after transactional-update dup (bsc#1228659)
* We also need to add 'Suggests: udev', which serves the same purpose as
'OrderWithRequires: udev' but is part of the repository metadata.
It should therefore hint zypper to install systemd and udev as close together as possible
- Fix systemd-network recommending libidn2-devel (bsc#1234765)
-----------------------------------------------------------------
Advisory ID: 305
Released: Fri Feb 20 16:44:31 2026
Summary: Recommended update for lvm2
Type: recommended
Severity: important
References: 1257661
This update for lvm2 fixes the following issues:
- L3: LVM_SUPPRESS_FD_WARNINGS is no longer effective (bsc#1257661)
* libdaemon: fix suppressing stray fd warnings
-----------------------------------------------------------------
Advisory ID: 310
Released: Thu Feb 26 08:38:22 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: low
References:
This update for openssl-3 fixes the following issues:
- removed test patches because they are not needed.
-----------------------------------------------------------------
Advisory ID: 314
Released: Thu Feb 26 17:51:31 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References:
This update for gcc15 fixes the following issues:
Update to GCC 15.2 release
* the GCC 15.2 release contains regression fixes accumulated since
the GCC 15.1 release
- Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
stack-clash protection loops
-----------------------------------------------------------------
Advisory ID: 325
Released: Fri Feb 27 14:03:55 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1205462,1214285,1215199,1235905,1242505,1242974,1242986,1243452,1243507,1243662,1246184,1246282,1247030,1247292,1247712,1248166,1248175,1248178,1248179,1248185,1248188,1248196,1248206,1248208,1248209,1248211,1248212,1248213,1248214,1248216,1248217,1248222,1248227,1248228,1248229,1248232,1248234,1248240,1248360,1248366,1248384,1248626,1249307,1249609,1249895,1249998,1250032,1250082,1250388,1250705,1250738,1250748,1252712,1252773,1252784,1252891,1252900,1253049,1253078,1253079,1253087,1253344,1253500,1253739,1254244,1254308,1254447,1254839,1254842,1254845,1254977,1255102,1255128,1255157,1255164,1255172,1255216,1255232,1255241,1255245,1255266,1255268,1255269,1255319,1255327,1255346,1255403,1255417,1255459,1255482,1255506,1255526,1255527,1255529,1255530,1255536,1255537,1255542,1255544,1255547,1255569,1255593,1255622,1255694,1255695,1255703,1255708,1255811,1255930,1256579,1256582,1256584,1256586,1256591,1256592,1256593,1256594,1256597,1256605,1256607,1256608,1256609,1256610,1
256611,1256612,1256613,1256616,1256617,1256619,1256622,1256623,1256625,1256627,1256628,1256630,1256632,1256638,1256641,1256643,1256645,1256646,1256650,1256651,1256653,1256654,1256655,1256656,1256659,1256660,1256661,1256664,1256665,1256667,1256668,1256674,1256677,1256680,1256682,1256683,1256688,1256689,1256716,1256726,1256728,1256730,1256733,1256737,1256741,1256742,1256744,1256748,1256749,1256752,1256754,1256755,1256756,1256757,1256759,1256760,1256761,1256763,1256770,1256773,1256774,1256777,1256779,1256781,1256785,1256792,1256793,1256794,1256864,1256865,1256867,1256975,1257015,1257035,1257053,1257154,1257155,1257158,1257159,1257163,1257164,1257167,1257168,1257179,1257180,1257202,1257204,1257207,1257208,1257215,1257217,1257218,1257220,1257221,1257225,1257227,1257232,1257234,1257236,1257243,1257245,1257276,1257277,1257279,1257282,1257296,1257309,1257473,1257504,1257603,CVE-2024-54031,CVE-2025-37744,CVE-2025-37751,CVE-2025-37841,CVE-2025-37845,CVE-2025-37904,CVE-2025-37955,CVE-2025-3824
3,CVE-2025-38262,CVE-2025-38297,CVE-2025-38298,CVE-2025-38379,CVE-2025-38423,CVE-2025-38505,CVE-2025-38507,CVE-2025-38510,CVE-2025-38511,CVE-2025-38512,CVE-2025-38513,CVE-2025-38515,CVE-2025-38516,CVE-2025-38520,CVE-2025-38521,CVE-2025-38529,CVE-2025-38530,CVE-2025-38535,CVE-2025-38537,CVE-2025-38538,CVE-2025-38539,CVE-2025-38540,CVE-2025-38541,CVE-2025-38543,CVE-2025-38547,CVE-2025-38548,CVE-2025-38550,CVE-2025-38551,CVE-2025-38569,CVE-2025-38589,CVE-2025-38590,CVE-2025-38645,CVE-2025-39689,CVE-2025-39795,CVE-2025-39813,CVE-2025-39814,CVE-2025-39817,CVE-2025-39829,CVE-2025-39880,CVE-2025-39913,CVE-2025-39927,CVE-2025-40030,CVE-2025-40045,CVE-2025-40097,CVE-2025-40106,CVE-2025-40147,CVE-2025-40195,CVE-2025-40257,CVE-2025-40259,CVE-2025-40261,CVE-2025-40363,CVE-2025-68174,CVE-2025-68178,CVE-2025-68188,CVE-2025-68200,CVE-2025-68211,CVE-2025-68218,CVE-2025-68227,CVE-2025-68241,CVE-2025-68245,CVE-2025-68261,CVE-2025-68296,CVE-2025-68297,CVE-2025-68320,CVE-2025-68325,CVE-2025-68337,CVE-2
025-68341,CVE-2025-68348,CVE-2025-68349,CVE-2025-68356,CVE-2025-68359,CVE-2025-68360,CVE-2025-68361,CVE-2025-68366,CVE-2025-68367,CVE-2025-68368,CVE-2025-68372,CVE-2025-68374,CVE-2025-68376,CVE-2025-68379,CVE-2025-68725,CVE-2025-68735,CVE-2025-68741,CVE-2025-68743,CVE-2025-68764,CVE-2025-68768,CVE-2025-68770,CVE-2025-68771,CVE-2025-68773,CVE-2025-68775,CVE-2025-68776,CVE-2025-68777,CVE-2025-68778,CVE-2025-68783,CVE-2025-68784,CVE-2025-68788,CVE-2025-68789,CVE-2025-68792,CVE-2025-68795,CVE-2025-68797,CVE-2025-68798,CVE-2025-68799,CVE-2025-68800,CVE-2025-68801,CVE-2025-68802,CVE-2025-68803,CVE-2025-68804,CVE-2025-68808,CVE-2025-68811,CVE-2025-68813,CVE-2025-68814,CVE-2025-68815,CVE-2025-68816,CVE-2025-68819,CVE-2025-68820,CVE-2025-68821,CVE-2025-68822,CVE-2025-71064,CVE-2025-71066,CVE-2025-71073,CVE-2025-71076,CVE-2025-71077,CVE-2025-71078,CVE-2025-71079,CVE-2025-71080,CVE-2025-71081,CVE-2025-71082,CVE-2025-71083,CVE-2025-71084,CVE-2025-71085,CVE-2025-71086,CVE-2025-71087,CVE-2025-710
88,CVE-2025-71089,CVE-2025-71091,CVE-2025-71093,CVE-2025-71094,CVE-2025-71095,CVE-2025-71097,CVE-2025-71098,CVE-2025-71099,CVE-2025-71100,CVE-2025-71101,CVE-2025-71108,CVE-2025-71111,CVE-2025-71112,CVE-2025-71113,CVE-2025-71114,CVE-2025-71116,CVE-2025-71118,CVE-2025-71119,CVE-2025-71120,CVE-2025-71123,CVE-2025-71126,CVE-2025-71130,CVE-2025-71131,CVE-2025-71132,CVE-2025-71133,CVE-2025-71135,CVE-2025-71136,CVE-2025-71137,CVE-2025-71138,CVE-2025-71141,CVE-2025-71142,CVE-2025-71143,CVE-2025-71145,CVE-2025-71147,CVE-2025-71148,CVE-2025-71149,CVE-2025-71154,CVE-2025-71156,CVE-2025-71157,CVE-2025-71162,CVE-2025-71163,CVE-2026-22976,CVE-2026-22977,CVE-2026-22978,CVE-2026-22981,CVE-2026-22982,CVE-2026-22984,CVE-2026-22985,CVE-2026-22986,CVE-2026-22988,CVE-2026-22989,CVE-2026-22990,CVE-2026-22991,CVE-2026-22992,CVE-2026-22993,CVE-2026-22996,CVE-2026-22997,CVE-2026-22999,CVE-2026-23000,CVE-2026-23001,CVE-2026-23002,CVE-2026-23005,CVE-2026-23006,CVE-2026-23011
The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
- CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
- CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
- CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
- CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
- CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
- CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
- CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
- CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
- CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
- CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
- CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
- CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
- CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
- CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
- CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
- CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).
- CVE-2025-68784: xfs: fix a UAF problem in xattr repair (bsc#1256793).
- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).
- CVE-2025-68792: tpm2-sessions: Fix out of range indexing in name_size (bsc#1256656).
- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).
- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).
- CVE-2025-68799: caif: fix integer underflow in cffrml_receive() (bsc#1256643).
- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).
- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).
- CVE-2025-68803: NFSD: NFSv4 file creation neglects setting ACL (bsc#1256770).
- CVE-2025-68811: svcrdma: use rc_pageoff for memcpy byte offset (bsc#1256677).
- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).
- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).
- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).
- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).
- CVE-2025-68821: fuse: fix readahead reclaim deadlock (bsc#1256667).
- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).
- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).
- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).
- CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (bsc#1256608).
- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).
- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).
- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).
- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).
- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).
- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).
- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).
- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).
- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).
- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).
- CVE-2025-71126: mptcp: avoid deadlock on fallback while reinjecting (bsc#1256755).
- CVE-2025-71132: smc91x: fix broken irq-context in PREEMPT_RT (bsc#1256737).
- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).
- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).
- CVE-2025-71137: octeontx2-pf: fix 'UBSAN: shift-out-of-bounds error' (bsc#1256760).
- CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).
- CVE-2025-71156: gve: defer interrupt enabling until NAPI registration (bsc#1257167).
- CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (bsc#1257168).
- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).
- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).
- CVE-2026-22981: idpf: detach and close netdevs while handling a reset (bsc#1257225).
- CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).
- CVE-2026-22986: gpiolib: fix race condition for gdev->srcu (bsc#1257276).
- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).
- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).
- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).
- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).
- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.
- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).
- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).
- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).
- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).
- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).
The following non security issues were fixed:
- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).
- Add bugnumber to an existing hv_netvsc change (bsc#1257473).
- Fix locking issue introduced by a CVE backport (bsc#1256975 bsc#1254977).
- Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)
- arm64: Update config files. Disable DEVPORT (bsc#1256792)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).
- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).
- btrfs: pass fs_info to btrfs_delete_ref_head() (git-fixes).
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes).
- bus: fsl-mc: Constify fsl_mc_device_match() (jsc#PED-10906 git-fixes).
- drm/imagination: Wait for FW trace update command completion (git-fixes).
- drm/msm/a6xx: fix bogus hwcg register updates (git-fixes).
- ice: use netif_get_num_default_rss_queues() (bsc#1247712).
- libbpf: Fix -Wdiscarded-qualifiers under C23 (bsc#1257309).
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).
- net: mana: Fix incorrect speed reported by debugfs (bsc#1255232).
- net: mana: Support HW link state events (bsc#1253049).
- nfsd: adjust WARN_ON_ONCE in revoke_delegation (bsc#1257015).
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (git-fixes).
- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).
- sched/fair: Disable scheduler feature NEXT_BUDDY (bsc#1255459).
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256864).
- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256864).
- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256865 bsc#1256867 jsc#PED-14156).
- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (bsc#1255346).
- slimbus: core: Constify slim_eaddr_equal() (jsc#PED-10906 git-fixes).
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).
- smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes).
- smb: improve directory cache reuse for readdir operations (bsc#1252712).
- tsm-mr: Add TVM Measurement Register support (bsc#1257504).
- tsm-mr: Add tsm-mr sample code (bsc#1257504).
- virt: tdx-guest: Expose TDX MRs as sysfs attributes (bsc#1257504).
- virt: tdx-guest: Refactor and streamline TDREPORT generation (bsc#1257504).
- virt: tdx-guest: Transition to scoped_cond_guard for mutex operations (bsc#1257504).
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).
- x86/tdx: Add tdx_mcall_extend_rtmr() interface (bsc#1257504).
- x86/tdx: tdx_mcall_get_report0: Return -EBUSY on TDCALL_OPERAND_BUSY error (bsc#1257504).
-----------------------------------------------------------------
Advisory ID: 338
Released: Tue Mar 3 09:57:47 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1254299,1254415,1258022
This update for grub2 fixes the following issues:
- Support dm multipath bootlist on PowerPC (bsc#1254415)
- Backport upstream's commit to prevent BIOS assert (bsc#1258022)
- Fix error 'grub-core/script/lexer.c:352:out of memory' after PowerPC CAS Reboot (bsc#1254299)
* Fix PowerPC CAS reboot to evaluate menu context
-----------------------------------------------------------------
Advisory ID: 353
Released: Wed Mar 4 11:51:24 2026
Summary: Security update for libxml2, libxslt
Type: security
Severity: moderate
References: 1247850,1247858,1250553,1256804,1256807,1256808,1256809,1256810,1256811,1256812,1257593,1257594,1257595,CVE-2025-10911,CVE-2025-8732,CVE-2026-0990,CVE-2026-0992,CVE-2026-1757
This update for libxml2, libxslt fixes the following issues:
Changes in libxml2:
- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in
`xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).
- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling
`nextCatalog` elements (bsc#1256809, bsc#1256812).
- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files
(bsc#1247858).
- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).
- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)
-----------------------------------------------------------------
Advisory ID: 358
Released: Thu Mar 5 15:21:04 2026
Summary: Recommended update for shim
Type: recommended
Severity: moderate
References: 1205588,1247432,1254336,1254679,CVE-2024-2312
This update for shim fixes the following issues:
This update for shim fixes the following issues:
shim is updated to version 16.1:
- shim_start_image(): fix guid/handle pairing when uninstalling protocols
- Fix uncompressed ipv6 netboot
- fix test segfaults caused by uninitialized memory
- SbatLevel_Variable.txt: minor typo fix.
- Realloc() needs to allocate one more byte for sprintf()
- IPv6: Add more check to avoid multiple double colon and illegal char
- Loader proto v2
- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
- Generate Authenticode for the entire PE file
- README: mention new loader protocol and interaction with UKIs
- shim: change automatically enable MOK_POLICY_REQUIRE_NX
- Save var info
- add SbatLevel entry 2025051000 for PSA-2025-00012-1
- Coverity fixes 20250804
- fix http boot
- Fix double free and leak in the loader protocol
shim is updated to version 16.0:
- Validate that a supplied vendor cert is not in PEM format
- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
- sbat: Also bump latest for grub,4 (and to todays date)
- undo change that limits certificate files to a single file
- shim: don't set second_stage to the empty string
- Fix SBAT.md for today's consensus about numbers
- Update Code of Conduct contact address
- make-certs: Handle missing OpenSSL installation
- Update MokVars.txt
- export DEFINES for sub makefile
- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
- Null-terminate 'arguments' in fallback
- Fix 'Verifiying' typo in error message
- Update Fedora CI targets
- Force gcc to produce DWARF4 so that gdb can use it
- Minor housekeeping 2024121700
- Discard load-options that start with WINDOWS
- Fix the issue that the gBS->LoadImage pointer was empty.
- shim: Allow data after the end of device path node in load options
- Handle network file not found like disks
- Update gnu-efi submodule for EFI_HTTP_ERROR
- Increase EFI file alignment
- avoid EFIv2 runtime services on Apple x86 machines
- Improve shortcut performance when comparing two boolean expressions
- Provide better error message when MokManager is not found
- tpm: Boot with a warning if the event log is full
- MokManager: remove redundant logical constraints
- Test import_mok_state() when MokListRT would be bigger than available size
- test-mok-mirror: minor bug fix
- Fix file system browser hang when enrolling MOK from disk
- Ignore a minor clang-tidy nit
- Allow fallback to default loader when encountering errors on network boot
- test.mk: don't use a temporary random.bin
- pe: Enhance debug report for update_mem_attrs
- Multiple certificate handling improvements
- Generate SbatLevel Metadata from SbatLevel_Variable.txt
- Apply EKU check with compile option
- Add configuration option to boot an alternative 2nd stage
- Loader protocol (with Device Path resolution support)
- netboot cleanup for additional files
- Document how revocations can be delivered
- post-process-pe: add tests to validate NX compliance
- regression: CopyMem() in ad8692e copies out of bounds
- Save the debug and error logs in mok-variables
- Add features for the Host Security ID program
- Mirror some more efi variables to mok-variables
- This adds DXE Services measurements to HSI and uses them for NX
- Add shim's current NX_COMPAT status to HSIStatus
- README.tpm: reflect that vendor_db is in fact logged as 'vendor_db'
- Reject HTTP message with duplicate Content-Length header fields
- Disable log saving
- fallback: don't add new boot order entries backwards
- README.tpm: Update MokList entry to MokListRT
- SBAT Level update for February 2025 GRUB CVEs
-----------------------------------------------------------------
Advisory ID: 396
Released: Tue Mar 17 15:49:10 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1257364,1257365,1258020,CVE-2025-28162,CVE-2025-28164,CVE-2026-25646
This update for libpng16 fixes the following issues:
- CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
- CVE-2025-28162: Fixed a memory leaks when running `pngimage`. (bsc#1257364)
- CVE-2025-28164: Fixed a memory leaks when running `pngimage`. (bsc#1257365)
-----------------------------------------------------------------
Advisory ID: 407
Released: Wed Mar 18 23:55:39 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Fixed bogus expression simplification (bsc#1257463)
-----------------------------------------------------------------
Advisory ID: 435
Released: Wed Mar 25 09:49:52 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1234634,1249590,1250748,1251135,1251966,1251971,1252008,1252266,1252911,1252924,1253129,1253691,1254817,1254928,1255129,1255144,1255148,1255311,1255490,1255572,1255721,1255868,1256640,1256675,1256679,1256708,1256732,1256784,1256802,1256865,1256867,1257154,1257174,1257209,1257222,1257228,1257231,1257246,1257332,1257466,1257472,1257473,1257551,1257552,1257553,1257554,1257556,1257557,1257559,1257560,1257561,1257562,1257565,1257570,1257572,1257573,1257576,1257579,1257580,1257581,1257586,1257600,1257631,1257635,1257679,1257682,1257686,1257687,1257688,1257704,1257705,1257706,1257707,1257709,1257714,1257715,1257716,1257718,1257722,1257723,1257726,1257729,1257730,1257732,1257734,1257735,1257737,1257739,1257740,1257741,1257742,1257743,1257745,1257749,1257750,1257755,1257757,1257758,1257759,1257761,1257762,1257763,1257765,1257768,1257770,1257772,1257775,1257776,1257788,1257789,1257790,1257805,1257808,1257809,1257811,1257813,1257814,1257815,1257816,1257817,1257818,1257830,1257942,1
257952,1258153,1258181,1258184,1258222,1258232,1258234,1258237,1258245,1258249,1258252,1258256,1258258,1258259,1258272,1258273,1258276,1258277,1258279,1258286,1258289,1258290,1258297,1258298,1258299,1258303,1258304,1258308,1258309,1258313,1258317,1258321,1258323,1258324,1258326,1258331,1258338,1258349,1258354,1258355,1258358,1258374,1258376,1258377,1258379,1258389,1258394,1258395,1258397,1258411,1258415,1258419,1258421,1258422,1258424,1258429,1258430,1258442,1258455,1258461,1258464,1258465,1258468,1258469,1258483,1258484,1258489,1258517,1258518,1258519,1258520,1258524,1258544,1258660,1258672,1258824,1259329,CVE-2025-39753,CVE-2025-39964,CVE-2025-40099,CVE-2025-40103,CVE-2025-40230,CVE-2025-68173,CVE-2025-68186,CVE-2025-68292,CVE-2025-68295,CVE-2025-68329,CVE-2025-68371,CVE-2025-68745,CVE-2025-68785,CVE-2025-68810,CVE-2025-68818,CVE-2025-71071,CVE-2025-71104,CVE-2025-71125,CVE-2025-71134,CVE-2025-71161,CVE-2025-71182,CVE-2025-71183,CVE-2025-71184,CVE-2025-71185,CVE-2025-71186,CVE-202
5-71188,CVE-2025-71189,CVE-2025-71190,CVE-2025-71191,CVE-2025-71192,CVE-2025-71193,CVE-2025-71194,CVE-2025-71195,CVE-2025-71196,CVE-2025-71197,CVE-2025-71198,CVE-2025-71199,CVE-2025-71200,CVE-2025-71222,CVE-2025-71224,CVE-2025-71225,CVE-2025-71229,CVE-2025-71231,CVE-2025-71232,CVE-2025-71233,CVE-2025-71234,CVE-2025-71235,CVE-2025-71236,CVE-2026-22979,CVE-2026-22980,CVE-2026-22998,CVE-2026-23003,CVE-2026-23004,CVE-2026-23010,CVE-2026-23017,CVE-2026-23018,CVE-2026-23021,CVE-2026-23022,CVE-2026-23023,CVE-2026-23024,CVE-2026-23026,CVE-2026-23030,CVE-2026-23031,CVE-2026-23033,CVE-2026-23035,CVE-2026-23037,CVE-2026-23038,CVE-2026-23042,CVE-2026-23047,CVE-2026-23049,CVE-2026-23050,CVE-2026-23053,CVE-2026-23054,CVE-2026-23055,CVE-2026-23056,CVE-2026-23057,CVE-2026-23058,CVE-2026-23059,CVE-2026-23060,CVE-2026-23061,CVE-2026-23062,CVE-2026-23063,CVE-2026-23064,CVE-2026-23065,CVE-2026-23066,CVE-2026-23068,CVE-2026-23069,CVE-2026-23070,CVE-2026-23071,CVE-2026-23073,CVE-2026-23074,CVE-2026-23076
,CVE-2026-23078,CVE-2026-23080,CVE-2026-23082,CVE-2026-23083,CVE-2026-23084,CVE-2026-23085,CVE-2026-23086,CVE-2026-23088,CVE-2026-23089,CVE-2026-23090,CVE-2026-23091,CVE-2026-23094,CVE-2026-23095,CVE-2026-23096,CVE-2026-23097,CVE-2026-23099,CVE-2026-23100,CVE-2026-23101,CVE-2026-23102,CVE-2026-23104,CVE-2026-23105,CVE-2026-23107,CVE-2026-23108,CVE-2026-23110,CVE-2026-23111,CVE-2026-23112,CVE-2026-23116,CVE-2026-23119,CVE-2026-23121,CVE-2026-23123,CVE-2026-23128,CVE-2026-23129,CVE-2026-23131,CVE-2026-23133,CVE-2026-23135,CVE-2026-23136,CVE-2026-23137,CVE-2026-23139,CVE-2026-23141,CVE-2026-23142,CVE-2026-23144,CVE-2026-23145,CVE-2026-23146,CVE-2026-23148,CVE-2026-23150,CVE-2026-23151,CVE-2026-23152,CVE-2026-23154,CVE-2026-23155,CVE-2026-23156,CVE-2026-23157,CVE-2026-23158,CVE-2026-23161,CVE-2026-23163,CVE-2026-23166,CVE-2026-23167,CVE-2026-23169,CVE-2026-23170,CVE-2026-23171,CVE-2026-23172,CVE-2026-23173,CVE-2026-23176,CVE-2026-23177,CVE-2026-23178,CVE-2026-23179,CVE-2026-23182,CVE-20
26-23188,CVE-2026-23189,CVE-2026-23190,CVE-2026-23191,CVE-2026-23198,CVE-2026-23202,CVE-2026-23207,CVE-2026-23208,CVE-2026-23209,CVE-2026-23210,CVE-2026-23213,CVE-2026-23214,CVE-2026-23221,CVE-2026-23222,CVE-2026-23223,CVE-2026-23224,CVE-2026-23229,CVE-2026-23230
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.
The following security issues were fixed:
- CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
- CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
- CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
- CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
- CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
- CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
- CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
- CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
- CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
- CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
- CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
- CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
- CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
- CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
- CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
- CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
- CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
- CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
- CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
- CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
- CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
- CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
- CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
- CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
- CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
- CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
- CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
- CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
- CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
- CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
- CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
- CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
- CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
- CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
- CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
- CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
- CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
- CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
- CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
- CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
- CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
- CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
- CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
- CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
- CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
- CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
- CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
- CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
- CVE-2026-23100: mm/hugetlb: fix hugetlb_pmd_shared() (bsc#1257817).
- CVE-2026-23102: arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772).
- CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
- CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (bsc#1257775).
- CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
- CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other (bsc#1257761).
- CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).
- CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
- CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
- CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
- CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
- CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
- CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
- CVE-2026-23142: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (bsc#1258289).
- CVE-2026-23144: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (bsc#1258290).
- CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (bsc#1258258).
- CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
- CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1258355).
- CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
- CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
- CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update (bsc#1258349).
- CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
- CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
- CVE-2026-23189: ceph: fix NULL pointer dereference in ceph_mds_auth_match() (bsc#1258308).
- CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
- CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
- CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
- CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
- CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
- CVE-2026-23223: xfs: fix UAF in xchk_btree_check_block_owner (bsc#1258483).
- CVE-2026-23224: erofs: fix UAF issue for file-backed mounts w/ directio option (bsc#1258461).
The following non security issues were fixed:
- ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes).
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes).
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes).
- Add bugnumber to existing mana and mana_ib changes (bsc#1251135 bsc#1251971).
- HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list (bsc#1258455).
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes).
- PCI/DOE: Poll DOE Busy bit for up to 1 second in pci_doe_send_req() (bsc#1255868).
- PCI: Add ASPEED vendor ID to pci_ids.h (bsc#1258672)
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (bsc#1258672)
- PM: sleep: wakeirq: Update outdated documentation comments (git-fixes).
- Refresh and move upstreamed ath12k patch into sorted section
- Update 'drm/mgag200: fix mgag200_bmc_stop_scanout()' bug number (bsc#1258153)
- add bugnumber to existing mana change (bsc#1252266).
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS (bsc#1259329)
- bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691).
- can: bcm: fix locking for bcm_op runtime updates (git-fixes).
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (git-fixes).
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (bsc#1257818).
- clocksource: Print durations for sync check unconditionally (bsc#1257818).
- clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1257818).
- clocksource: Use pr_info() for 'Checking clocksource synchronization' message (bsc#1257818).
- dm: Fix deadlock when reloading a multipath table (bsc#1254928).
- drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129).
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes).
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (git-fixes).
- i3c: master: Update hot-join flag only on success (git-fixes).
- ktls, sockmap: Fix missing uncharge operation (bsc#1252008).
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes).
- modpost: Ensure exported symbol namespaces are not quoted (bsc#1258489).
- net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
- net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
- platform/x86/amd: amd_3d_vcache: Add AMD 3D V-Cache optimizer driver (jsc#PED-11563).
- sched/core: Avoid direct access to hrtimer clockbase (bsc#1234634).
- sched/deadline: Fix race in push_dl_task() (bsc#1234634).
- sched/deadline: Stop dl_server before CPU goes offline (bsc#1234634).
- sched/fair: Fix pelt clock sync when entering idle (bsc#1234634).
- sched/fair: Fix pelt lost idle time detection (bsc#1234634).
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes).
- wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes).
-----------------------------------------------------------------
Advisory ID: 480
Released: Tue Apr 7 13:57:38 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1260754,1260755,CVE-2026-33416,CVE-2026-33636
This update for libpng16 fixes the following issues:
- CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code
execution (bsc#1260754).
- CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and
crashes (bsc#1260755).
-----------------------------------------------------------------
Advisory ID: 484
Released: Tue Apr 7 16:33:05 2026
Summary: Security update for libtasn1
Type: security
Severity: moderate
References: 1256341,CVE-2025-13151
This update for libtasn1 fixes the following issues:
- CVE-2025-13151: lack of validation of input data size leads to stack-based buffer overflow in
`asn1_expend_octet_string` (bsc#1256341).
-----------------------------------------------------------------
Advisory ID: 485
Released: Tue Apr 7 17:17:05 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1255326,1258344,1259418,1259650,1259697,CVE-2026-29111,CVE-2026-4105
This update for systemd fixes the following issues:
Update to systemd v257.13:
Security issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).
Non security issues:
- Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
- Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
Changelog:
- 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
- 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
- 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
- fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28
-----------------------------------------------------------------
Advisory ID: 502
Released: Thu Apr 9 13:18:30 2026
Summary: Security update for zlib
Type: security
Severity: moderate
References: 1216378,1258392,CVE-2023-45853,CVE-2026-27171
This update for zlib fixes the following issues:
- CVE-2026-27171: Fixed an infinite loop via the crc32_combine64 and crc32_combine_gen64 functions due to missing checks for negative lengths. (bsc#1258392)
- CVE-2023-45853: Fixed an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6. (bsc#1216378)
-----------------------------------------------------------------
Advisory ID: 510
Released: Thu Apr 9 15:00:19 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1222465,1254666,1258859,CVE-2025-14104,CVE-2026-3184
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
-----------------------------------------------------------------
Advisory ID: 516
Released: Fri Apr 10 08:36:43 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1258319,1260078,1260082,CVE-2026-4437,CVE-2026-4438
This update for glibc fixes the following issues:
Security fixes:
- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).
Other fixes:
- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).
-----------------------------------------------------------------
Advisory ID: 528
Released: Fri Apr 10 20:29:30 2026
Summary: Security update for pcre2
Type: security
Severity: moderate
References: 1248842,CVE-2025-58050
This update for pcre2 fixes the following issue:
- CVE-2025-58050: integer overflow leads to heap buffer overread in match_ref due to missing boundary restoration in SCS
(bsc#1248842).
-----------------------------------------------------------------
Advisory ID: 544
Released: Mon Apr 13 15:10:32 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: moderate
References: 1252696,1253025
This update for crypto-policies fixes the following issues:
- Fix the testsuite:
* Port all the policy changes to the config files in the test suite.
* Use the newly introduced SKIP_LINTING=1 option.
- Adapt the manpages to SUSE/openSUSE:
* Add crypto policies SUSE manpages
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: (bsc#1253025, bsc#1252696)
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH and MLKEM768-X25519 and SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add crypto policies FIPS output
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
-----------------------------------------------------------------
Advisory ID: 547
Released: Mon Apr 13 17:48:00 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1260441,1260442,1260443,1260444,1260445,1261678,CVE-2026-2673,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
This update for openssl-3 fixes the following issues:
Security issues fixed:
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).
- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).
- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).
- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo (bsc#1261678).
- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).
- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).
Other updates and bugfixes:
- Enable MD2 in legacy provider (jsc#PED-15724).
-----------------------------------------------------------------
Advisory ID: 556
Released: Tue Apr 14 16:33:17 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1232234,CVE-2024-10041
This update for pam fixes the following issue:
- CVE-2024-10041: libpam: vulnerable to read hashed password (bsc#1232234).
-----------------------------------------------------------------
Advisory ID: 574
Released: Thu Apr 16 12:19:06 2026
Summary: Recommended update for update-bootloader
Type: recommended
Severity: moderate
References: 1246013
This update for update-bootloader fixes the following issues:
- Upgrade to version 1.27:
* adjust spec file for immutable mode: switch to using
* systemd-tmpfiles (jsc#PED-14833)
- Upgrade to version 1.26:
* adjust test cases
- Implement config for BLS (bsc#1246013)
-----------------------------------------------------------------
Advisory ID: 585
Released: Fri Apr 17 12:37:59 2026
Summary: Feature update for libgcrypt, libgpg-error
Type: feature
Severity: moderate
References: CVE-2024-2236
This update for libgcrypt, libgpg-error fixes the following issues:
Update libgcrypt to 1.12.1 (jsc#PED-15059):
* New and extended interfaces:
- Allow access to the FIPS service indicator via the new
GCRYCTL_FIPS_SERVICE_INDICATOR control code.
- Make SHA-1 non-FIPS internally for the 1.12 API
- Add Dilithium (ML-DSA) support
- Support optional random-override and support byte string data
* Bug fixes:
- Use secure MPI in _gcry_mpi_assign_limb_space.
- Use CSIDL_COMMON_APPDATA instead of /etc on Windows.
- Apply a Kyber patch from upstream.
- Fix an edge case in Jent initialization.
- mceliece6688128f: Fix stack overflow crash on win64/wine
* Performance:
- Many performance improvements, new AVX512 implementations for modern CPUs.
- Add RISC-V Zbb+Zbc implementation of CRC.
- Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512
- Add AVX2 and AVX512 code paths to improve CRC.
For a full changelog, see:
https://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0
Update libgpg-error to 1.58:
* New src/gpg-error.c (main): New command 'fconcat'.
* Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to
ENVP.
* argparse: Use SYSCONFDIR for /etc.
* Update translations for Portugese, German
* src/estream.c (parse_mode): Fix parsing of 'share'. Set sysopen
flag.
* syscfg: Add 64-bit Android arch.
-----------------------------------------------------------------
Advisory ID: 596
Released: Mon Apr 20 19:16:35 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1191256,1191270,1194778,1207184,1217845,1222768,1243208,1252073,1253129,1254214,1254306,1254307,1255084,1255687,1256647,1257183,1257511,1257708,1257773,1257777,1258175,1258280,1258293,1258301,1258305,1258330,1258337,1258340,1258414,1258447,1258476,1258849,1259188,1259461,1259484,1259485,1259580,1259707,1259759,1259795,1259797,1259870,1259886,1259891,1259955,1259997,1259998,1260005,1260009,1260347,1260459,1260464,1260471,1260481,1260486,1260490,1260497,1260500,1260522,1260527,1260544,1260550,1260606,1260730,1260732,1260735,1260799,1261496,1261498,1261506,1261507,1261669,CVE-2025-39998,CVE-2025-40253,CVE-2025-68794,CVE-2025-71239,CVE-2026-23072,CVE-2026-23103,CVE-2026-23120,CVE-2026-23125,CVE-2026-23138,CVE-2026-23140,CVE-2026-23187,CVE-2026-23193,CVE-2026-23201,CVE-2026-23204,CVE-2026-23215,CVE-2026-23216,CVE-2026-23231,CVE-2026-23239,CVE-2026-23240,CVE-2026-23242,CVE-2026-23243,CVE-2026-23255,CVE-2026-23262,CVE-2026-23270,CVE-2026-23272,CVE-2026-23274,CVE-2026-23277,CVE-
2026-23278,CVE-2026-23281,CVE-2026-23292,CVE-2026-23293,CVE-2026-23297,CVE-2026-23304,CVE-2026-23319,CVE-2026-23326,CVE-2026-23335,CVE-2026-23343,CVE-2026-23361,CVE-2026-23379,CVE-2026-23381,CVE-2026-23383,CVE-2026-23386,CVE-2026-23393,CVE-2026-23398,CVE-2026-23413,CVE-2026-23414,CVE-2026-23419,CVE-2026-23425,CVE-2026-31788
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
- CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
- CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
- CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
- CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
- CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
- CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
- CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
- CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
- CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
- CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
- CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
- CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
- CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
- CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
- CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
- CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
- CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
- CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
- CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
- CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
- CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
- CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
- CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
- CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
- CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
- CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
- CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
- CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
- CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
- CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
- CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
- CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
- CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
- CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
- CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
- CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
- CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
- CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
- CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
- CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
- CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
- CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
- CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
- CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
- CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
- CVE-2026-23425: KVM: arm64: Fix ID register initialization for non-protected pKVM guests (bsc#1261506).
- CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).
The following non security issues were fixed:
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461).
- KVM: x86: synthesize CPUID bits only if CPU capability is set (bsc#1257511).
- Revert 'drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129).'
- Update config files (bsc#1254307).
- apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849).
- apparmor: fix differential encoding verification (bsc#1258849).
- apparmor: fix memory leak in verify_header (bsc#1258849).
- apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849).
- apparmor: fix race between freeing data and fs accessing it (bsc#1258849).
- apparmor: fix race on rawdata dereference (bsc#1258849).
- apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849).
- apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849).
- apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849).
- apparmor: replace recursive profile removal with iterative approach (bsc#1258849).
- apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).
- bpf, btf: Enforce destructor kfunc type with CFI (bsc#1259955).
- bpf: crypto: Use the correct destructor kfunc type (bsc#1259955).
- btrfs: only enforce free space tree if v1 cache is required for bs < ps cases (bsc#1260459).
- btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777).
- dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (git-fixes).
- drm/amdkfd: Unreserve bo if queue update failed (git-fixes).
- drm/i915/display: Add module param to skip retraining of dp link (bsc#1253129).
- drm/i915/dsc: Add Selective Update register definitions (stable-fixes).
- drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters (stable-fixes).
- firmware: microchip: fail auto-update probe if no flash found (git-fixes).
- kABI: Include trace recursion bits in kABI tracking (bsc#1258301).
- net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).
- nvme: add support for dynamic quirk configuration via module parameter (bsc#1243208).
- nvme: expose active quirks in sysfs (bsc#1243208).
- nvme: fix memory leak in quirks_param_set() (bsc#1243208).
- powerpc/crash: adjust the elfcorehdr size (jsc#PED-11175 git-fixes).
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (jsc#PED-11175 git-fixes).
- s390/cio: Update purge function to unregister the unused subchannels (bsc#1254214).
- s390/ipl: Clear SBP flag when bootprog is set (bsc#1258175).
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306).
- scsi: fnic: Add Cisco hardware model names (jsc#PED-15441).
- scsi: fnic: Add and integrate support for FDMI (jsc#PED-15441).
- scsi: fnic: Add and integrate support for FIP (jsc#PED-15441).
- scsi: fnic: Add functionality in fnic to support FDLS (jsc#PED-15441).
- scsi: fnic: Add headers and definitions for FDLS (jsc#PED-15441).
- scsi: fnic: Add stats and related functionality (jsc#PED-15441).
- scsi: fnic: Add support for fabric based solicited requests and responses (jsc#PED-15441).
- scsi: fnic: Add support for target based solicited requests and responses (jsc#PED-15441).
- scsi: fnic: Add support for unsolicited requests and responses (jsc#PED-15441).
- scsi: fnic: Add support to handle port channel RSCN (jsc#PED-15441).
- scsi: fnic: Code cleanup (jsc#PED-15441).
- scsi: fnic: Delete incorrect debugfs error handling (jsc#PED-15441).
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (jsc#PED-15441).
- scsi: fnic: Fix indentation and remove unnecessary parenthesis (jsc#PED-15441).
- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (jsc#PED-15441).
- scsi: fnic: Fix use of uninitialized value in debug message (jsc#PED-15441).
- scsi: fnic: Increment driver version (jsc#PED-15441).
- scsi: fnic: Modify IO path to use FDLS (jsc#PED-15441).
- scsi: fnic: Modify fnic interfaces to use FDLS (jsc#PED-15441).
- scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (jsc#PED-15441).
- scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (jsc#PED-15441).
- scsi: fnic: Remove extern definition from .c files (jsc#PED-15441).
- scsi: fnic: Remove unnecessary debug print (jsc#PED-15441).
- scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (jsc#PED-15441).
- scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (jsc#PED-15441).
- scsi: fnic: Remove unnecessary spinlock locking and unlocking (jsc#PED-15441).
- scsi: fnic: Replace fnic->lock_flags with local flags (jsc#PED-15441).
- scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (jsc#PED-15441).
- scsi: fnic: Replace use of sizeof with standard usage (jsc#PED-15441).
- scsi: fnic: Return appropriate error code for mem alloc failure (jsc#PED-15441).
- scsi: fnic: Return appropriate error code from failure of scsi drv init (jsc#PED-15441).
- scsi: fnic: Test for memory allocation failure and return error code (jsc#PED-15441).
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (jsc#PED-15441).
- scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1255687).
- scsi: scsi_transport_sas: Fix the maximum channel scanning issue (bsc#1255687, git-fixes).
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (git-fixes, jsc#PED-15042).
- selftests/bpf: Use the correct destructor kfunc type (bsc#1259955).
- selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590).
- tg3: Fix race for querying speed/duplex (bsc#1257183).
- x86/platform/uv: Handle deconfigured sockets (bsc#1260347).
-----------------------------------------------------------------
Advisory ID: 603
Released: Tue Apr 21 11:59:18 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1261957,CVE-2026-34757
This update for libpng16 fixes the following issue:
- CVE-2026-34757: libpng: Information disclosure and data corruption via use-after-free vulnerability (bsc#1261957).
-----------------------------------------------------------------
Advisory ID: 625
Released: Wed Apr 22 12:22:37 2026
Summary: Security update for libcap
Type: security
Severity: important
References: 1261809,CVE-2026-4878
This update for libcap fixes the following issues:
- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
`cap_set_file()` (bsc#1261809).
-----------------------------------------------------------------
Advisory ID: 637
Released: Fri Apr 24 12:00:57 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1221126,1259543
This update for grub2 fixes the following issues:
- Fix missing install device check in grub2-install on PowerPC which could lead
to bootlist corruption (bsc#1221126)
* add mandatoryminstallmdevicemcheckmformPowerPC
- Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543)
* btrfs: add ability to boot from subvolumes
* btrfs: get default subvolume
-----------------------------------------------------------------
Advisory ID: 666
Released: Sat May 2 11:18:56 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1262573,CVE-2026-31431
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2026-31431: The copy.fail security issue is fixed by revert to operating out-of-place in algif_aead (bsc#1262573).
-----------------------------------------------------------------
Advisory ID: 708
Released: Wed May 6 12:44:56 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1261639
This update for libselinux fixes the following issues:
- Backport commit 'libselinux: retain LIFO order for path substitutions' (bsc#1261639)
* otherwise we can not add equivalencies that overload each other in the policy
* libselinux: retain LIFO order for path substitutions
-----------------------------------------------------------------
Advisory ID: 734
Released: Tue May 12 17:13:15 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1264449,1264450,CVE-2026-43284,CVE-2026-43500
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
Dirty Frag fixes:
- CVE-2026-43500: supported.conf: drop rxrpc completely (bsc#1264450)
- CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
-----------------------------------------------------------------
Advisory ID: 753
Released: Fri May 15 18:52:59 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1264013,1265209,CVE-2025-54518,CVE-2026-46300
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
- CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
-----------------------------------------------------------------
Advisory ID: 761
Released: Mon May 18 07:38:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues
- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).
-----------------------------------------------------------------
Advisory ID: 780
Released: Mon May 18 16:13:40 2026
Summary: Recommended update for the Linux Kernel
Type: recommended
Severity: important
References: 1265308,CVE-2026-46333
The SUSE Linux Enterprise 16.0 kernel was updated to fix one issue
The following non security issue was fixed:
- CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).
-----------------------------------------------------------------
Advisory ID: 803
Released: Tue May 26 14:14:16 2026
Summary: Security update for xz
Type: security
Severity: important
References: 1261280,CVE-2026-34743
This update for xz fixes the following issue
- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
-----------------------------------------------------------------
Advisory ID: 814
Released: Thu May 28 14:58:58 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1215199,1234634,1241259,1243603,1248754,1249104,1250951,1253471,1254518,1255160,1255360,1255459,1255752,1256288,1256865,1256867,1258518,1258718,1258826,1258849,1258850,1258854,1258855,1258856,1258857,1258933,1258961,1259186,1259199,1259222,1259420,1259461,1259535,1259672,1259799,1259806,1259857,1259865,1259868,1259869,1259871,1259873,1259878,1259889,1259994,1260010,1260012,1260018,1260428,1260468,1260483,1260484,1260485,1260489,1260504,1260505,1260507,1260514,1260523,1260526,1260528,1260529,1260530,1260531,1260532,1260533,1260536,1260537,1260538,1260541,1260546,1260549,1260551,1260552,1260555,1260561,1260562,1260566,1260571,1260572,1260573,1260576,1260580,1260581,1260593,1260613,1260728,1260729,1260731,1260798,1260800,1260801,1260807,1260811,1260996,1261020,1261149,1261287,1261288,1261295,1261348,1261410,1261503,1261504,1261505,1261550,1261555,1261581,1261582,1261584,1261585,1261592,1261601,1261602,1261617,1261618,1261629,1261632,1261635,1261636,1261637,1261638,1261641,1
261644,1261645,1261648,1261679,1261685,1261686,1261687,1261692,1261694,1261700,1261702,1261703,1261707,1261710,1261713,1261714,1261719,1261738,1261750,1261751,1261752,1261768,1261778,1261779,1261780,1261781,1261786,1261788,1261789,1261796,1261797,1261896,1262019,1262053,1262054,1262055,1262061,1262063,1262074,1262078,1262086,1262087,1262099,1262100,1262101,1262179,1262181,1262245,1262250,1262480,1262601,1262616,1262617,1262627,1262662,1262665,1262671,1262673,1262709,1262725,1262731,1262750,1262752,1262758,1263001,1263012,1263018,1263044,1263048,1263052,1263064,1263074,1263077,1263085,1263093,1263095,1263104,1263107,1263131,1263135,1263138,1263140,1263141,1263165,1263176,1263255,1263556,1263562,1263582,1263592,1263593,1263595,1263596,1263604,1263668,1263815,1263882,1263901,1263931,1263933,1263942,1263995,1264014,1264059,1264082,1264097,1264183,1264233,1264427,1264469,1264586,1264674,1264837,1264848,1265085,1265116,1265119,1265144,1265308,1265421,1265449,1265456,1265626,1265846,126596
0,CVE-2023-20585,CVE-2024-14027,CVE-2025-40181,CVE-2025-40219,CVE-2025-68265,CVE-2025-68310,CVE-2025-71238,CVE-2025-71268,CVE-2025-71269,CVE-2025-71302,CVE-2026-23168,CVE-2026-23209,CVE-2026-23236,CVE-2026-23237,CVE-2026-23245,CVE-2026-23246,CVE-2026-23253,CVE-2026-23260,CVE-2026-23261,CVE-2026-23264,CVE-2026-23266,CVE-2026-23268,CVE-2026-23269,CVE-2026-23271,CVE-2026-23273,CVE-2026-23276,CVE-2026-23279,CVE-2026-23290,CVE-2026-23291,CVE-2026-23298,CVE-2026-23300,CVE-2026-23307,CVE-2026-23312,CVE-2026-23313,CVE-2026-23315,CVE-2026-23316,CVE-2026-23317,CVE-2026-23318,CVE-2026-23321,CVE-2026-23324,CVE-2026-23325,CVE-2026-23334,CVE-2026-23336,CVE-2026-23339,CVE-2026-23340,CVE-2026-23346,CVE-2026-23347,CVE-2026-23351,CVE-2026-23354,CVE-2026-23357,CVE-2026-23360,CVE-2026-23362,CVE-2026-23363,CVE-2026-23365,CVE-2026-23367,CVE-2026-23368,CVE-2026-23369,CVE-2026-23370,CVE-2026-23372,CVE-2026-23373,CVE-2026-23374,CVE-2026-23375,CVE-2026-23378,CVE-2026-23382,CVE-2026-23387,CVE-2026-23391,CVE-2
026-23392,CVE-2026-23395,CVE-2026-23396,CVE-2026-23397,CVE-2026-23399,CVE-2026-23401,CVE-2026-23403,CVE-2026-23404,CVE-2026-23405,CVE-2026-23406,CVE-2026-23407,CVE-2026-23408,CVE-2026-23409,CVE-2026-23410,CVE-2026-23411,CVE-2026-23417,CVE-2026-23418,CVE-2026-23420,CVE-2026-23426,CVE-2026-23434,CVE-2026-23436,CVE-2026-23437,CVE-2026-23440,CVE-2026-23441,CVE-2026-23442,CVE-2026-23443,CVE-2026-23445,CVE-2026-23446,CVE-2026-23447,CVE-2026-23448,CVE-2026-23449,CVE-2026-23450,CVE-2026-23452,CVE-2026-23454,CVE-2026-23455,CVE-2026-23456,CVE-2026-23457,CVE-2026-23458,CVE-2026-23460,CVE-2026-23461,CVE-2026-23462,CVE-2026-23463,CVE-2026-23464,CVE-2026-23465,CVE-2026-23466,CVE-2026-23468,CVE-2026-23470,CVE-2026-23472,CVE-2026-23473,CVE-2026-23474,CVE-2026-23475,CVE-2026-31389,CVE-2026-31392,CVE-2026-31393,CVE-2026-31394,CVE-2026-31395,CVE-2026-31400,CVE-2026-31402,CVE-2026-31403,CVE-2026-31405,CVE-2026-31406,CVE-2026-31407,CVE-2026-31408,CVE-2026-31411,CVE-2026-31412,CVE-2026-31415,CVE-2026-314
16,CVE-2026-31417,CVE-2026-31420,CVE-2026-31421,CVE-2026-31422,CVE-2026-31423,CVE-2026-31424,CVE-2026-31425,CVE-2026-31426,CVE-2026-31427,CVE-2026-31428,CVE-2026-31435,CVE-2026-31449,CVE-2026-31453,CVE-2026-31456,CVE-2026-31470,CVE-2026-31494,CVE-2026-31496,CVE-2026-31503,CVE-2026-31504,CVE-2026-31505,CVE-2026-31507,CVE-2026-31515,CVE-2026-31519,CVE-2026-31525,CVE-2026-31526,CVE-2026-31528,CVE-2026-31533,CVE-2026-31547,CVE-2026-31550,CVE-2026-31554,CVE-2026-31565,CVE-2026-31579,CVE-2026-31586,CVE-2026-31588,CVE-2026-31644,CVE-2026-31649,CVE-2026-31658,CVE-2026-31662,CVE-2026-31666,CVE-2026-31668,CVE-2026-31669,CVE-2026-31675,CVE-2026-31678,CVE-2026-31679,CVE-2026-31681,CVE-2026-31682,CVE-2026-31684,CVE-2026-31685,CVE-2026-31691,CVE-2026-31694,CVE-2026-31700,CVE-2026-31738,CVE-2026-31787,CVE-2026-43009,CVE-2026-43025,CVE-2026-43027,CVE-2026-43037,CVE-2026-43038,CVE-2026-43045,CVE-2026-43050,CVE-2026-43060,CVE-2026-43082,CVE-2026-43088,CVE-2026-43153,CVE-2026-43190,CVE-2026-43265,CVE-
2026-43329,CVE-2026-43365,CVE-2026-43366,CVE-2026-43441,CVE-2026-43494,CVE-2026-43503,CVE-2026-46333
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).
- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).
- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).
- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).
- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).
- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).
- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).
- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).
- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).
- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).
- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).
- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).
- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).
- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).
- CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001).
- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).
- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).
- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).
- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).
- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).
- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).
- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).
- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).
- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).
- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).
- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).
- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).
- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
- CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
- CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).
- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).
- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).
- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).
- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).
- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).
- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).
- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).
- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).
- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).
- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
The following non security issues were fixed:
- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).
- ACPI: AGDI: fix missing newline in error message (git-fixes).
- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).
- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).
- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).
- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).
- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).
- ALSA: 6fire: Fix input volume change detection (git-fixes).
- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).
- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).
- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).
- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).
- ALSA: aoa: Use guard() for mutex locks (stable-fixes).
- ALSA: asihpi: avoid write overflow check warning (stable-fixes).
- ALSA: caiaq: Don't abort when no input device is available (git-fixes).
- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).
- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).
- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).
- ALSA: caiaq: Handle probe errors properly (git-fixes).
- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).
- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).
- ALSA: core: Fix potential data race at fasync handling (git-fixes).
- ALSA: core: Serialize deferred fasync state checks (git-fixes).
- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).
- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).
- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).
- ALSA: ctxfi: Limit PTP to a single page (git-fixes).
- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).
- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).
- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).
- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).
- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).
- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).
- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).
- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).
- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).
- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).
- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).
- ALSA: misc: Use guard() for spin locks (stable-fixes).
- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).
- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).
- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).
- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).
- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).
- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).
- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).
- ALSA: seq: Notify client and port info changes (stable-fixes).
- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).
- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).
- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).
- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).
- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).
- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).
- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).
- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).
- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).
- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).
- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).
- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).
- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).
- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).
- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).
- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).
- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).
- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).
- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).
- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).
- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).
- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).
- ASoC: fsl_easrc: fix comment typo (git-fixes).
- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).
- ASoC: fsl_micfil: Add access property for 'VAD Detected' (git-fixes).
- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).
- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).
- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).
- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).
- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).
- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).
- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).
- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).
- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).
- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).
- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).
- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).
- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).
- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).
- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).
- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).
- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).
- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).
- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).
- ASoC: sti: use managed regmap_field allocations (git-fixes).
- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).
- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).
- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).
- batman-adv: bla: only purge non-released claims (git-fixes).
- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).
- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).
- batman-adv: fix integer overflow on buff_pos (git-fixes).
- batman-adv: hold claim backbone gateways by reference (git-fixes).
- batman-adv: reject new tp_meter sessions during teardown (git-fixes).
- batman-adv: reject oversized global TT response buffers (git-fixes).
- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).
- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).
- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).
- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).
- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).
- Bluetooth: hci_event: fix memset typo (git-fixes).
- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).
- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).
- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).
- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).
- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).
- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).
- Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec (git-fixes).
- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).
- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).
- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).
- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).
- bpf: Add third round of bounds deduction (git-fixes).
- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).
- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).
- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).
- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).
- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).
- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).
- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).
- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).
- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).
- can: raw: fix ro->uniq use-after-free in raw_rcv() (git-fixes).
- can: ucan: fix devres lifetime (git-fixes).
- cdc-acm: new quirk for EPSON HMD (stable-fixes).
- check-for-config-changes: Exclude CC_MS_EXTENSIONS.
- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).
- cpufreq: intel_pstate: Drop Arrow Lake from 'scaling factor' list (bsc#1249104).
- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).
- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).
- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).
- crypto: atmel-ecc - Release client on allocation failure (git-fixes).
- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).
- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).
- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).
- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).
- crypto: atmel-tdes - fix DMA sync direction (git-fixes).
- crypto: ccp - copy IV using skcipher ivsize (git-fixes).
- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).
- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).
- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).
- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).
- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).
- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).
- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).
- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).
- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).
- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).
- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).
- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).
- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).
- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).
- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).
- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).
- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).
- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).
- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).
- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).
- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).
- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).
- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).
- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).
- crypto: qat - add decompression service to telemetry (jsc#PED-14238).
- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).
- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).
- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).
- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).
- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).
- crypto: qat - add missing header inclusion (jsc#PED-14238).
- crypto: qat - add qat_6xxx driver (jsc#PED-14238).
- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).
- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).
- crypto: qat - consolidate service enums (jsc#PED-14238).
- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).
- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).
- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).
- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).
- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).
- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).
- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).
- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).
- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).
- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).
- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).
- crypto: qat - expose configuration functions (jsc#PED-14238).
- crypto: qat - fix compression instance leak (git-fixes).
- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).
- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.
- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).
- crypto: qat - Fix typo 'accelaration' (jsc#PED-14238).
- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).
- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).
- crypto: qat - introduce fuse array (jsc#PED-14238).
- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).
- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).
- crypto: qat - refactor compression template logic (jsc#PED-14238).
- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).
- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).
- crypto: qat - refactor service parsing logic (jsc#PED-14238).
- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).
- crypto: qat - relocate bank state helper functions (jsc#PED-14238).
- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).
- crypto: qat - relocate service related functions (jsc#PED-14238).
- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).
- crypto: qat - Remove dst_null support (jsc#PED-14238).
- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).
- crypto: qat - remove initialization in device class (jsc#PED-14238).
- crypto: qat - remove redundant FW image size check (jsc#PED-14238).
- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).
- crypto: qat - remove unused members in suof structure (jsc#PED-14238).
- crypto: qat - rename and relocate timer logic (jsc#PED-14238).
- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).
- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).
- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).
- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).
- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).
- crypto: qat - set command ids as reserved (jsc#PED-14238).
- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).
- crypto: qat - update firmware api (jsc#PED-14238).
- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).
- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).
- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).
- crypto: qat - use swab32 macro (git-fixes).
- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).
- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).
- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).
- crypto: simd - reject compat registrations without __ prefixes (git-fixes).
- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).
- crypto: tegra - Disable softirqs before finalizing request (git-fixes).
- devres: fix missing node debug info in devm_krealloc() (git-fixes).
- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).
- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).
- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).
- dpll: zl3073x: Add support to adjust phase (bsc#1255752).
- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).
- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).
- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).
- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).
- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).
- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).
- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).
- drm/amd/display: Correct logic check error for fastboot (git-fixes).
- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).
- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).
- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).
- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).
- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).
- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).
- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).
- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).
- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).
- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).
- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).
- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).
- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).
- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).
- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).
- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).
- drm/amdgpu/pm: add missing revision check for CI (git-fixes).
- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).
- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).
- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).
- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).
- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).
- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).
- drm/amdgpu: Add default case in DVI mode validation (git-fixes).
- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).
- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).
- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).
- drm/amdgpu: replace PASID IDR with XArray (git-fixes).
- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).
- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).
- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).
- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).
- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).
- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).
- drm/arcpgu: fix device node leak (git-fixes).
- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).
- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).
- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).
- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).
- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).
- drm/exynos: remove bridge when component_add fails (git-fixes).
- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).
- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).
- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).
- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).
- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).
- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).
- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).
- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).
- drm/loongson: Use managed KMS polling (git-fixes).
- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).
- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).
- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).
- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).
- drm/msm/dsi: add the missing parameter description (git-fixes).
- drm/msm/dsi: fix bits_per_pclk (git-fixes).
- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).
- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).
- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).
- drm/msm/shrinker: Fix can_block() logic (git-fixes).
- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).
- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).
- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).
- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).
- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).
- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).
- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).
- drm/panthor: Fix outdated function documentation (git-fixes).
- drm/radeon: add missing revision check for CI (git-fixes).
- drm/sun4i: backend: fix error pointer dereference (git-fixes).
- drm/sun4i: Fix resource leaks (git-fixes).
- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).
- drm/vc4: Fix a memory leak in hang state error path (git-fixes).
- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).
- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).
- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).
- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).
- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).
- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).
- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).
- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).
- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).
- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).
- drm/xe/uapi: update used tracking kernel-doc (git-fixes).
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).
- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).
- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).
- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).
- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).
- ext4: fix fsync(2) for nojournal mode (git-fixes).
- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).
- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).
- extcon: Fixed sysfs duplicate filename issue (git-fixes).
- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).
- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).
- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).
- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).
- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).
- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).
- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).
- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).
- firmware: google: framebuffer: Do not unregister platform device (git-fixes).
- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).
- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).
- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).
- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).
- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).
- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).
- HID: asus: do not abort probe when not necessary (git-fixes).
- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).
- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).
- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).
- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).
- HID: multitouch: Check to ensure report responses match the request (stable-fixes).
- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).
- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).
- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).
- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).
- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).
- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).
- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).
- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).
- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).
- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).
- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS('PMBUS') (git-fixes).
- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).
- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).
- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).
- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).
- i2c: smbus: reject oversized block transfers in the common path (git-fixes).
- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).
- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).
- i2c: tegra: Add HS mode support (bsc#1261550).
- i2c: tegra: Add Tegra256 support (bsc#1261550).
- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).
- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).
- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).
- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).
- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).
- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).
- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).
- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).
- iio: adc: ad7192: Revert 'properly check spi_get_device_match_data()' (stable-fixes).
- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).
- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).
- iio: frequency: admv1013: add dev variable (stable-fixes).
- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).
- Input: bcm5974 - recover from failed mode switch (stable-fixes).
- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).
- Input: uinput - fix circular locking dependency with ff-core (git-fixes).
- Input: uinput - take event lock when submitting FF request 'event' (stable-fixes).
- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).
- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).
- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).
- io_uring/timeout: check unused sqe fields (git-fixes).
- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).
- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).
- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).
- ipmi: Add limits to event and receive message requests (git-fixes).
- ipmi: Check event message buffer response for bad data (git-fixes).
- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).
- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).
- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).
- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).
- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).
- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).
- KVM: arm64: Consolidate idreg callbacks (git-fixes).
- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).
- KVM: arm64: Finalize ID registers only once per VM (git-fixes).
- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).
- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).
- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).
- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).
- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).
- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).
- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).
- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).
- KVM: arm64: nv: Add trap config for DBGWCR<15>_EL1 (git-fixes).
- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).
- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).
- KVM: arm64: Read PMUVer as unsigned (git-fixes).
- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).
- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).
- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).
- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).
- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
- KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).
- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).
- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).
- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).
- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).
- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).
- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (git-fixes).
- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).
- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).
- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).
- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).
- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).
- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).
- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).
- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).
- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).
- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).
- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).
- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).
- leds: lgm-sso: Remove duplicate assignments for priv->mmap (git-fixes).
- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).
- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).
- md/raid1: fix the comparing region of interval tree (bsc#1261555).
- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).
- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).
- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).
- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).
- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).
- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).
- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).
- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).
- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).
- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).
- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).
- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).
- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).
- media: i2c: ov08d10: fix image vertical start setting (git-fixes).
- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).
- media: intel/ipu6: fix error pointer dereference (git-fixes).
- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).
- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).
- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).
- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).
- media: rc: streamzap: Error handling in probe (git-fixes).
- media: rc: xbox_remote: heed DMA restrictions (git-fixes).
- media: saa7164: add ioremap return checks and cleanups (git-fixes).
- media: staging: imx: configure src_mux in csi_start (git-fixes).
- media: staging: imx: request mbus_config in csi_start (git-fixes).
- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).
- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).
- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).
- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).
- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).
- memory: tegra30-emc: Fix dll_change check (git-fixes).
- memory: tegra124-emc: Fix dll_change check (git-fixes).
- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).
- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).
- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).
- mkspec: Add signature to source list only when it exists.
- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).
- mmc: vub300: fix NULL-deref on disconnect (git-fixes).
- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).
- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).
- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).
- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).
- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).
- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).
- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).
- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).
- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).
- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).
- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).
- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).
- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).
- net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).
- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).
- net: gro: don't merge zcopy skbs (git-fixes).
- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).
- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).
- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).
- net: mana: Fix RX skb truesize accounting (bsc#1248754).
- net: mana: Guard mana_remove against double invocation (git-fixes).
- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).
- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).
- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).
- net: mana: Init link_change_work before potential error paths in probe (git-fixes).
- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Set default number of queues to 16 (bsc#1261648).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).
- net: mana: Use pci_name() for debugfs directory naming (git-fixes).
- net: phy: broadcom: Save PHY counters during suspend (git-fixes).
- net: phy: DP83TC811: add reading of abilities (git-fixes).
- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).
- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).
- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).
- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).
- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).
- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).
- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).
- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).
- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).
- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).
- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).
- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).
- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).
- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).
- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).
- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).
- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).
- nvme-apple: drop invalid put of admin queue reference count (git-fixes).
- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).
- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).
- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).
- nvme: Allow reauth from sysfs (bsc#1259672).
- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).
- nvme: expose TLS mode (bsc#1259672).
- nvme: fix admin queue leak on controller reset (git-fixes).
- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).
- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).
- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).
- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).
- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).
- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).
- panic: introduce helper functions for panic state (bsc#1261149).
- panic: use angle-bracket include for panic.h (bsc#1261149).
- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).
- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).
- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).
- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).
- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).
- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).
- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).
- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).
- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).
- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).
- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).
- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).
- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).
- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).
- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).
- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).
- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).
- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).
- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).
- PCI: tegra194: Fix polling delay for L2 state (git-fixes).
- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).
- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).
- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).
- PCI: tegra194: Use devm_gpiod_get_optional() to parse 'nvidia,refclk-select' (git-fixes).
- PCI: tegra194: Use DWC IP core version (git-fixes).
- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).
- pinctrl: Fix spelling problem (git-fixes).
- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).
- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).
- pinctrl: pic32: use consistent spacing around '+' (git-fixes).
- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).
- pinctrl: realtek: Fix function signature for config argument (git-fixes).
- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).
- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).
- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).
- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).
- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).
- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).
- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).
- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).
- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).
- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).
- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).
- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).
- power: supply: max17042: avoid overflow when determining health (git-fixes).
- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).
- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).
- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).
- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).
- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).
- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).
- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).
- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).
- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).
- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).
- printk: Avoid scheduling irq_work on suspend (bsc#1262750).
- printk: console_flush_one_record() code cleanup (bsc#1261149).
- printk: Introduce console_flush_one_record (bsc#1261149).
- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).
- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).
- qat: don't mess with ->d_name (jsc#PED-14238).
- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).
- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).
- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).
- RDMA/mana_ib: Support memory windows (git-fixes).
- regulator: act8945a: fix OF node reference imbalance (git-fixes).
- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).
- regulator: max77650: fix OF node reference imbalance (git-fixes).
- regulator: mt6357: fix OF node reference imbalance (git-fixes).
- regulator: rk808: fix OF node reference imbalance (git-fixes).
- remoteproc: xlnx: Fix sram property parsing (git-fixes).
- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).
- Revert 'ALSA: usb: Increase volume range that triggers a warning' (git-fixes).
- Revert 'serial: 8250: Revert 'drop lockdep annotation from serial8250_clear_IER()'' (bsc#1262480).
- Revert 'serial: 8250: Switch to nbcon console' (bsc#1262480).
- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).
- rtc: ntxec: fix OF node reference imbalance (git-fixes).
- s390/dasd: Copy detected format information to secondary device (bsc#1259994).
- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).
- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).
- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).
- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).
- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).
- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).
- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).
- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).
- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).
- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).
- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).
- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).
- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).
- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).
- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).
- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).
- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).
- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).
- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).
- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).
- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).
- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).
- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).
- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).
- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).
- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).
- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).
- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).
- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).
- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).
- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).
- scsi: lpfc: Use the crc32c() function (bsc#1262019).
- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).
- scsi: ses: Fix devices attaching to different hosts (git-fixes).
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).
- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).
- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).
- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).
- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).
- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).
- selftests: net: build net/lib dependency in all target (bsc#1262245).
- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).
- selinux: prune /sys/fs/selinux/disable (stable-fixes).
- selinux: shrink critical section in sel_write_load() (stable-fixes).
- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).
- serial: 8250: Protect LCR write in shutdown (bsc#1262480).
- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).
- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).
- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).
- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).
- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).
- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).
- soc: qcom: aoss: compare against normalized cooling state (git-fixes).
- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).
- soc: qcom: ocmem: make the core clock optional (git-fixes).
- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).
- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).
- sound: ua101: fix division by zero at probe (git-fixes).
- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).
- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).
- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).
- spi: aspeed-smc: fix controller deregistration (git-fixes).
- spi: at91-usart: fix controller deregistration (git-fixes).
- spi: atmel: fix controller deregistration (git-fixes).
- spi: bcm63xx: fix controller deregistration (git-fixes).
- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).
- spi: cadence: fix controller deregistration (git-fixes).
- spi: cadence: fix unclocked access on unbind (git-fixes).
- spi: ch341: fix memory leaks on probe failures (git-fixes).
- spi: coldfire-qspi: fix controller deregistration (git-fixes).
- spi: dln2: fix controller deregistration (git-fixes).
- spi: fix controller cleanup() documentation (git-fixes).
- spi: fix misleading controller deregistration kernel-doc (git-fixes).
- spi: fix misleading controller registration kernel-doc (git-fixes).
- spi: fsl-espi: fix controller deregistration (git-fixes).
- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).
- spi: fsl: fix controller deregistration (git-fixes).
- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).
- spi: img-spfi: fix controller deregistration (git-fixes).
- spi: imx: fix runtime pm leak on probe deferral (git-fixes).
- spi: imx: fix use-after-free on unbind (git-fixes).
- spi: lantiq-ssc: fix controller deregistration (git-fixes).
- spi: meson-spicc: fix controller deregistration (git-fixes).
- spi: microchip-core-qspi: fix controller deregistration (git-fixes).
- spi: mpc52xx: fix controller deregistration (git-fixes).
- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).
- spi: mpc52xx: fix use-after-free on unbind (git-fixes).
- spi: mtk-nor: fix controller deregistration (git-fixes).
- spi: mtk-snfi: fix memory leak in probe (git-fixes).
- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).
- spi: mxic: fix controller deregistration (git-fixes).
- spi: mxs: fix controller deregistration (git-fixes).
- spi: npcm-pspi: fix controller deregistration (git-fixes).
- spi: omap2-mcspi: fix controller deregistration (git-fixes).
- spi: orion: fix clock imbalance on registration failure (git-fixes).
- spi: orion: fix controller deregistration (git-fixes).
- spi: orion: fix runtime pm leak on unbind (git-fixes).
- spi: pic32-sqi: fix controller deregistration (git-fixes).
- spi: pic32: fix controller deregistration (git-fixes).
- spi: pl022: fix controller deregistration (git-fixes).
- spi: qup: fix controller deregistration (git-fixes).
- spi: rockchip: fix controller deregistration (git-fixes).
- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).
- spi: rspi: fix controller deregistration (git-fixes).
- spi: s3c64xx: fix controller deregistration (git-fixes).
- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).
- spi: sh-hspi: fix controller deregistration (git-fixes).
- spi: sprd: fix controller deregistration (git-fixes).
- spi: st-ssc4: fix controller deregistration (git-fixes).
- spi: sun4i: fix controller deregistration (git-fixes).
- spi: sun6i: fix controller deregistration (git-fixes).
- spi: syncuacer: fix controller deregistration (git-fixes).
- spi: ti-qspi: fix controller deregistration (git-fixes).
- spi: topcliff-pch: fix controller deregistration (git-fixes).
- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).
- spi: uniphier: fix controller deregistration (git-fixes).
- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).
- spi: zynq-qspi: fix controller deregistration (git-fixes).
- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).
- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).
- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).
- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).
- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).
- staging: vme_user: fix root device leak on init failure (git-fixes).
- tg3: replace placeholder MAC address with device property (git-fixes).
- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).
- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).
- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).
- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).
- tools: hv: Fix cross-compilation (git-fixes).
- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).
- tpm: avoid -Wunused-but-set-variable (git-fixes).
- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).
- tpm: tpm_tis: add error logging for data transfer (git-fixes).
- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).
- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).
- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).
- udp: Force compute_score to always inline (bsc#1241259).
- unshare: fix unshare_fs() handling (git-fixes).
- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).
- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).
- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).
- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).
- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).
- usb: gadget: f_hid: Add missing error code (git-fixes).
- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).
- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).
- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).
- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).
- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).
- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).
- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).
- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).
- usb: port: add delay after usb_hub_set_port_power() (git-fixes).
- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).
- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).
- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).
- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).
- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).
- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).
- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).
- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).
- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).
- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).
- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).
- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).
- vfio/pds: Fix missing detach_ioas op (git-fixes).
- vfio/pds: replace bitmap_free with vfree (git-fixes).
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).
- vfio: Prevent open_count decrement to negative (git-fixes).
- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).
- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).
- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).
- virt: tdx-guest: Return error for GetQuote failures (git-fixes).
- wifi: ath5k: do not access array OOB (git-fixes).
- wifi: ath9k: Fix typo (git-fixes).
- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).
- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).
- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).
- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).
- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).
- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).
- wifi: brcmfmac: Fix error pointer dereference (git-fixes).
- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).
- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).
- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).
- wifi: cw1200: Revert 'Fix locking in error paths' (git-fixes).
- wifi: libertas: notify firmware load wait on disconnect (git-fixes).
- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).
- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).
- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).
- wifi: mac80211: remove station if connection prep fails (git-fixes).
- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).
- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).
- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).
- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).
- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).
- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).
- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).
- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).
- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).
- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).
- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).
- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).
- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).
- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).
- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).
- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).
- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).
- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).
- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).
- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).
- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).
- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).
- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).
- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).
- wifi: rt2x00usb: fix devres lifetime (git-fixes).
- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).
- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).
- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).
- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).
- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).
- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).
- wifi: rtw88: fix device leak on probe failure (git-fixes).
- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).
- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).
- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).
- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).
- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).
- x86/cpufeatures: Free up unused feature bits (bsc#1263255).
- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).
- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).
- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).
- x86/sev: Make sure pages are not skipped during kdump (git-fixes).
- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).
- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).
- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).
- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).
- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).
-----------------------------------------------------------------
Advisory ID: 824
Released: Fri May 29 11:59:18 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1258311,1259825,1262315
This update for crypto-policies fixes the following issues:
Changes in crypto-policies:
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy again. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
-----------------------------------------------------------------
Advisory ID: 897
Released: Fri Jun 5 20:24:53 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1243603,1260539,1260584,1261590,1262634,1262656,1262668,1262754,1262755,1262771,1263067,1263068,1263102,1263169,1263769,1263774,1263908,1264011,1264014,1264016,1264063,1264112,1264300,1264409,1264437,1264669,1264716,1264719,1264720,1264722,1264726,1264832,1264989,1265044,1265110,1265925,1265928,1266001,1266238,1266307,1266395,1266402,1266414,1266759,1266765,CVE-2023-20585,CVE-2026-23359,CVE-2026-23380,CVE-2026-23444,CVE-2026-31464,CVE-2026-31480,CVE-2026-31483,CVE-2026-31493,CVE-2026-31516,CVE-2026-31521,CVE-2026-31568,CVE-2026-31575,CVE-2026-31580,CVE-2026-31613,CVE-2026-31614,CVE-2026-31729,CVE-2026-31736,CVE-2026-43009,CVE-2026-43012,CVE-2026-43013,CVE-2026-43054,CVE-2026-43112,CVE-2026-43234,CVE-2026-43252,CVE-2026-43325,CVE-2026-43328,CVE-2026-43333,CVE-2026-43338,CVE-2026-43341,CVE-2026-43359,CVE-2026-43360,CVE-2026-43361,CVE-2026-43362,CVE-2026-43414,CVE-2026-43499,CVE-2026-45843,CVE-2026-46110,CVE-2026-46243
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).
- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).
- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).
- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).
- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).
- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).
- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).
- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).
- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).
- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).
- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).
- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).
- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).
- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).
- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).
- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).
- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).
- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).
- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).
- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).
- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).
- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() (bsc#1266759).
The following non security issues were fixed:
- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).
- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).
- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).
- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).
- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).
- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).
- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).
- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).
- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).
- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).
- ALSA: ua101: Reject too-short USB descriptors (git-fixes).
- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).
- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).
- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).
- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).
- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).
- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).
- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).
- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).
- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).
- bcache: fix uninitialized closure object (git-fixes).
- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).
- Bluetooth: bnep: Fix UAF read of dev->name (git-fixes).
- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths (git-fixes).
- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).
- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).
- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).
- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).
- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (git-fixes).
- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).
- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).
- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).
- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).
- Bluetooth: serialize accept_q access (git-fixes).
- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).
- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).
- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).
- device property: set fwnode->secondary to NULL in fwnode_init() (git-fixes).
- dm: fix a buffer overflow in ioctl processing (git-fixes).
- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).
- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).
- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).
- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).
- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).
- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).
- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).
- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).
- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).
- drm/amdgpu: fix spelling typos (stable-fixes).
- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).
- drm/amdgpu: update the handle ptr in early_init (stable-fixes).
- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).
- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).
- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).
- drm/i915: Fix potential UAF in TTM object purge (git-fixes).
- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).
- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).
- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).
- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).
- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).
- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).
- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).
- drm/xe/vf: Fix signature of print functions (git-fixes).
- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).
- efi: Allocate runtime workqueue before ACPI init (git-fixes).
- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).
- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).
- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).
- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).
- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).
- gve: add XDP DROP and PASS support for DQ (bsc#1265925).
- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).
- gve: introduce config-based allocation for XDP (bsc#1265925).
- gve: merge packet buffer size fields (bsc#1265925).
- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).
- gve: update GQ RX to use buf_size (bsc#1265925).
- gve: Update QPL page registration logic (bsc#1265925).
- gve: update XDP allocation path support RX buffer posting (bsc#1265925).
- HID: playstation: Clamp num_touch_reports (git-fixes).
- HID: quirks: really enable the intended work around for appledisplay (git-fixes).
- HID: uclogic: Fix regression of input name assignment (git-fixes).
- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).
- hwmon: (lenovo-ec-sensors): Fix EC 'MCHP' signature validation logic (git-fixes).
- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).
- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).
- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).
- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).
- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).
- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).
- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).
- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).
- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).
- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).
- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).
- iio: dac: ad5686: fix input raw value check (git-fixes).
- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).
- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).
- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).
- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).
- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).
- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).
- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).
- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).
- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).
- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).
- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).
- Input: xpad - fix out-of-bounds access for Share button (git-fixes).
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).
- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).
- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).
- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).
- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).
- media: i2c: og01a1b: Replace client->dev usage (stable-fixes).
- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).
- net: mana: Skip redundant detach on already-detached port (git-fixes).
- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
- parport: Fix race between port and client registration (git-fixes).
- platform/surface: aggregator_registry: omit battery & AC nodes on Surface Laptop 7 (git-fixes).
- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).
- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).
- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).
- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).
- RDMA/efa: Extend admin timeout error print (git-fixes).
- RDMA/efa: Fix possible deadlock (git-fixes).
- RDMA/efa: Improve admin completion context state machine (git-fixes).
- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
- Revert 'ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn' (git-fixes).
- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).
- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).
- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).
- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).
- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).
- security/keys: fix missed RCU read section on lookup (stable-fixes).
- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).
- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).
- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).
- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).
- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).
- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).
- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).
- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).
- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).
- thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (git-fixes).
- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).
- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).
- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).
- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).
- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).
- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).
- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).
- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).
- usb: dwc2: Fix use after free in debug code (git-fixes).
- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).
- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).
- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).
- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).
- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).
- usb: gadget: net2280: Fix double free in probe error path (git-fixes).
- usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind (git-fixes).
- USB: serial: belkin_sa: validate interrupt status length (git-fixes).
- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).
- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).
- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).
- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).
- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).
- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).
- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).
- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).
- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).
- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).
- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).
- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).
- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).
- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).
- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).
- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).
- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).
- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).
- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).
- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).
- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).
- wifi: mac80211: fix MLE defragmentation (git-fixes).
- wifi: mac80211: fix multi-link element inheritance (git-fixes).
-----------------------------------------------------------------
Advisory ID: 929
Released: Mon Jun 15 15:44:30 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1259884,1260502,1260548,1261041,1261603,1261619,1261791,1262606,1262615,1262619,1262622,1262624,1263006,1263058,1263062,1263115,1263180,1263579,1263594,1263724,1263794,1263883,1263932,1264000,1264040,1264091,1264196,1264243,1264245,1264255,1264415,1264484,1264609,1264622,1264672,1264723,1264765,1265081,1265114,1265170,1265186,1265579,1266394,1266400,1266696,1266711,1266720,1266810,1266816,1266826,1266827,1266888,1266889,1266901,1266914,1266927,1266972,1267205,1267214,1267220,1267531,1267652,1267875,1268018,CVE-2026-23254,CVE-2026-23303,CVE-2026-23327,CVE-2026-23438,CVE-2026-31396,CVE-2026-31401,CVE-2026-31446,CVE-2026-31448,CVE-2026-31454,CVE-2026-31455,CVE-2026-31518,CVE-2026-31546,CVE-2026-31556,CVE-2026-31562,CVE-2026-31584,CVE-2026-31645,CVE-2026-31648,CVE-2026-31655,CVE-2026-31671,CVE-2026-31683,CVE-2026-31703,CVE-2026-31774,CVE-2026-43026,CVE-2026-43030,CVE-2026-43040,CVE-2026-43063,CVE-2026-43065,CVE-2026-43066,CVE-2026-43068,CVE-2026-43109,CVE-2026-43150,CVE-2026
-43184,CVE-2026-43197,CVE-2026-43332,CVE-2026-43393,CVE-2026-43394,CVE-2026-43411,CVE-2026-43455,CVE-2026-45842,CVE-2026-45846,CVE-2026-45852,CVE-2026-45856,CVE-2026-45886,CVE-2026-45898,CVE-2026-45910,CVE-2026-45932,CVE-2026-45942,CVE-2026-45970,CVE-2026-45984,CVE-2026-46021,CVE-2026-46043,CVE-2026-46083,CVE-2026-46090,CVE-2026-46094,CVE-2026-46114,CVE-2026-46159,CVE-2026-46176,CVE-2026-46181,CVE-2026-46316,CVE-2026-46317
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
- CVE-2026-23327: cxl/mbox: validate payload size before accessing
contents in cxl_payload_from_user_allowed() (bsc#1260548).
- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
- CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
- CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
- CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
- CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
- CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
- CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
- CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize
nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
- CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
- CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
- CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
- CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
- CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
- CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
- CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
- CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
- CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).
- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).
The following non security issues were fixed:
- accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
- Bluetooth: bnep: reject short frames before parsing (git-fixes).
- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
- config: remove DEBUG_FS_DISALLOW_MOUNT
- debugfs: Remove broken no-mount mode (bsc#1265186).
- debugfs: Fix default access mode config check (bsc#1265186).
- debugfs: Remove broken no-mount mode (bsc#1265186).
- debugfs: Remove redundant access mode checks (bsc#1265186).
- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
- drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
- ima: return error early if file xattr cannot be changed (bsc#1261041).
- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
- KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
- KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
- KVM: SVM: Convert plain error code numbers to defines (git-fixes).
- KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
- KVM: SVM: Provide helpers to set the error code (git-fixes).
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
- KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
- KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
- KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
- KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
- KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
- mmc: core: Fix host controller programming for fixed driver type (git-fixes).
- mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).
-----------------------------------------------------------------
Advisory ID: 964
Released: Fri Jun 19 16:14:03 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions from time_t to/from uint32_t.
Filter out -Wtime_t-conversion from flags to build D target library files.
- SUSE-local -Wtime_t-conversion patch added. [jsc#PED-15601]
- Fix for bogus expression simplification [bsc#1257463]
- Enable the use of _dl_find_object even when not available at build time.
[bsc#1253043]
- Fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Fixes PR110812, Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: 1004
Released: Sat Jun 20 20:11:34 2026
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1259924,CVE-2025-69720
This update for ncurses fixes the following issue:
- CVE-2025-69720: buffer overflow in function `analyze_string()`of `progs/infocmp.c` (bsc#1259924).
-----------------------------------------------------------------
Advisory ID: 996
Released: Sat Jun 20 20:17:58 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1232226
This update for libselinux fixes the following issues:
- Backport patch for restorecon to log error on readonly fs (bsc#1232226)
-----------------------------------------------------------------
Advisory ID: 1017
Released: Mon Jun 22 14:26:17 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1266340,1266341,1266342,1266344,1266345,1266347,1266349,1266350,1266351,1266352,1266353,1266355,1266356,1266357,CVE-2026-2673,CVE-2026-34180,CVE-2026-34182,CVE-2026-34183,CVE-2026-42764,CVE-2026-42766,CVE-2026-42767,CVE-2026-42768,CVE-2026-42769,CVE-2026-42770,CVE-2026-45445,CVE-2026-45446,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-3 fixes the following issues
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: 1036
Released: Mon Jun 22 16:30:37 2026
Summary: Security update for sed
Type: security
Severity: moderate
References: 1262144,CVE-2026-5958
This update for sed fixes the following issue
- CVE-2026-5958: a TOCTOU race can allow to read attacker-controlled content and write it to an unintended file
(bsc#1262144).
-----------------------------------------------------------------
Advisory ID: 1040
Released: Mon Jun 22 16:34:40 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1261606,CVE-2026-27456
This update for util-linux fixes the following issue
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
-----------------------------------------------------------------
Advisory ID: 1047
Released: Mon Jun 22 17:08:34 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1257055
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.65:
* Remove erofs from the list of blacklisted file systems (jsc#PED-14573)
* weak-modules2: don't remove symlinks in the rpm --reinstall case (bsc#1257055)
-----------------------------------------------------------------
Advisory ID: 1060
Released: Wed Jun 24 23:36:29 2026
Summary: Security update for libgcrypt
Type: security
Severity: low
References: 1262693,CVE-2026-41990
This update for libgcrypt fixes the following issue
- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).
-----------------------------------------------------------------
Advisory ID: 1064
Released: Wed Jun 24 23:38:49 2026
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1245524
This update for pam fixes the following issues:
- pam_mkhomedir: building with vendordir option allows fetching skeleton directory
from the vendor directory when creating the user home directory (bsc#1245524)
- disable unix_chkpwd by default, only used as fallback again
- pam_modutil_get*: overwrite password at free
-----------------------------------------------------------------
Advisory ID: 1103
Released: Mon Jun 29 10:05:18 2026
Summary: Recommended update for fuse3
Type: recommended
Severity: moderate
References: 1256466
This update for fuse3 fixes the following issues:
- Add dependency from libfuse3-4 to fusermount3 program (bsc#1256466)
-----------------------------------------------------------------
Advisory ID: 1151
Released: Fri Jul 3 10:55:00 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1245551,1248261,1251948,1254924,1259071,1260357,1261982,1261983,1262305,1263117,1267644,1267647
This update for systemd fixes the following issues:
Changes in systemd:
- Better handle TLS allocation failure (bsc#1254924).
- Disable mounting `debugfs` by default (jsc#PED-8812).
- Import commit 9e8b5afe0fb2061f4a17a3022469dd62f2683960 (bsc#1267647 bsc#1267644 bsc#1262305 bsc#1263117).
- Move `systemd-pcrlock` out from the experimental sub-package to `udev` (bsc#1248261 jsc#PED-15946).
- Add a weak runtime dependency on `libtss2-tcti-device0` (bsc#1260357).
- Import commit 59336000ef7850eba0963c6a690ff3371c425929 (bsc#1261982 bsc#1261983).
- Add a weak runtime dependency on `polkit` (bsc#1259071).
- systemd-update-helper: fix the clean-state command only removing `$STATE_DIR/system` instead of `$STATE_DIR/`.
- systemd-update-helper: add `--root` option for testing convenience.
- systemd-update-helper: fix incorrect skipping of `systemctl disable` during package removal (bsc#1245551).
- systemd-update-helper: fix `do_install_units()` incorrectly returning 1 when no units need preset.
- systemd.spec: introduce `%bcond_without` docs to allow skipping man pages and `devel-doc`.
- systemd.spec: drop the `%{release}` number from the SBAT version (bsc#1251948).
-----------------------------------------------------------------
Advisory ID: 1157
Released: Fri Jul 3 15:19:16 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: 1191
Released: Thu Jul 9 14:39:23 2026
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1270439
This update for systemd fixes the following issues:
Changes in systemd:
- do not make mounting of debugfs optional yet.
-----------------------------------------------------------------
Advisory ID: 1220
Released: Mon Jul 13 09:51:58 2026
Summary: Security update for libxml2
Type: security
Severity: important
References: 1262719,1269790,CVE-2026-11979,CVE-2026-6732
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).
-----------------------------------------------------------------
Advisory ID: 1224
Released: Mon Jul 13 15:54:55 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: 1276
Released: Thu Jul 16 20:48:33 2026
Summary: Security update for freetype2
Type: security
Severity: moderate
References: 1252148,1259118,1271045,CVE-2026-23865,CVE-2026-50811
This update for freetype2 fixes the following issues
- Update to version 2.14.3
- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).
- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).
-----------------------------------------------------------------
Advisory ID: 1280
Released: Sat Jul 18 10:12:44 2026
Summary: Security update for gzip
Type: security
Severity: important
References: 1269622,CVE-2026-41991
This update for gzip fixes the following issue
- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the
user's PATH (bsc#1269622).
-----------------------------------------------------------------
Advisory ID: 1294
Released: Mon Jul 20 11:26:51 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).
-----------------------------------------------------------------
Advisory ID: 1303
Released: Mon Jul 20 15:44:04 2026
Summary: Security update for gawk
Type: security
Severity: moderate
References: 1271351,1271352,1271354,CVE-2026-40467,CVE-2026-40468,CVE-2026-40553
This update for gawk fixes the following issues:
- CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash
(bsc#1271351).
- CVE-2026-40468: use-after-free vulnerability in gawk's 'io.c' file could permit heap metadata manipulation and host
memory exhaustion (bsc#1271352).
- CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash
(bsc#1271354).
-----------------------------------------------------------------
Advisory ID: 1295
Released: Tue Jul 21 10:27:32 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1149651,1204315,1236743,1255029,1257506,1258538,1259800,1260565,1261250,1261256,1261562,1261604,1262085,1262392,1262430,1262618,1262620,1262674,1262748,1262765,1262798,1263057,1263072,1263133,1263137,1263143,1263169,1263178,1263319,1263563,1263568,1263573,1263578,1263581,1263796,1263930,1263934,1263993,1263996,1263998,1264001,1264007,1264010,1264012,1264015,1264045,1264056,1264067,1264084,1264145,1264230,1264231,1264236,1264239,1264241,1264250,1264254,1264258,1264261,1264263,1264266,1264270,1264286,1264294,1264295,1264302,1264304,1264320,1264328,1264333,1264337,1264372,1264386,1264429,1264449,1264532,1264544,1264545,1264548,1264549,1264556,1264561,1264580,1264595,1264603,1264610,1264612,1264614,1264624,1264643,1264734,1264740,1264741,1264744,1264763,1264789,1264790,1264794,1264852,1264974,1264978,1264997,1265000,1265005,1265020,1265023,1265073,1265079,1265082,1265084,1265091,1265097,1265103,1265112,1265113,1265123,1265128,1265129,1265142,1265143,1265628,1265629,1266008,1
266214,1266283,1266284,1266290,1266390,1266396,1266397,1266398,1266452,1266458,1266686,1266693,1266697,1266698,1266700,1266704,1266705,1266717,1266718,1266722,1266726,1266734,1266740,1266750,1266754,1266761,1266773,1266805,1266830,1266838,1266840,1266847,1266878,1266883,1266892,1266893,1266895,1266899,1266903,1266916,1266922,1266925,1266929,1266933,1267208,1267218,1267228,1267238,1267251,1267360,1267361,1267365,1267369,1267387,1267419,1267427,1267431,1267437,1267458,1267493,1267505,1267548,1267582,1267591,1267600,1267618,1267624,1267626,1267628,1267635,1267637,1267640,1267654,1267682,1267684,1267685,1267697,1267717,1267722,1267732,1267744,1267816,1267824,1267825,1267937,1267966,1267992,1267993,1267994,1268022,1268037,1268237,1268238,1268276,1268307,1268335,1268428,1268660,1268661,1268989,1269022,1269031,1269033,1269036,1269087,1269103,1269135,1269136,1269137,1269151,1269159,1269164,1269188,1269193,1269199,1269230,1269234,1269252,1269262,1269288,1269310,1269389,1269392,1269397,126939
8,1269416,1269418,1269493,1269506,1269519,1269527,1269531,1269532,1269537,1269587,1269617,1269645,1269646,1269647,1269651,1269680,1269690,1269691,1269700,1269708,1269710,1269768,1269795,1269798,1269809,1269814,1269821,1269904,1269982,1269989,1269992,1270000,1270022,1270042,1270059,1270226,1271366,CVE-2025-10263,CVE-2025-39894,CVE-2025-40341,CVE-2026-23248,CVE-2026-23394,CVE-2026-23451,CVE-2026-31414,CVE-2026-31429,CVE-2026-31438,CVE-2026-31450,CVE-2026-31452,CVE-2026-31466,CVE-2026-31469,CVE-2026-31479,CVE-2026-31492,CVE-2026-31495,CVE-2026-31499,CVE-2026-31502,CVE-2026-31555,CVE-2026-31560,CVE-2026-31580,CVE-2026-31596,CVE-2026-31646,CVE-2026-31647,CVE-2026-31663,CVE-2026-31664,CVE-2026-31665,CVE-2026-31670,CVE-2026-31673,CVE-2026-31674,CVE-2026-31680,CVE-2026-31693,CVE-2026-31743,CVE-2026-31752,CVE-2026-31771,CVE-2026-43010,CVE-2026-43014,CVE-2026-43015,CVE-2026-43016,CVE-2026-43022,CVE-2026-43024,CVE-2026-43028,CVE-2026-43034,CVE-2026-43035,CVE-2026-43036,CVE-2026-43053,CVE-2026-
43057,CVE-2026-43074,CVE-2026-43080,CVE-2026-43081,CVE-2026-43083,CVE-2026-43085,CVE-2026-43086,CVE-2026-43089,CVE-2026-43090,CVE-2026-43092,CVE-2026-43093,CVE-2026-43094,CVE-2026-43101,CVE-2026-43107,CVE-2026-43119,CVE-2026-43124,CVE-2026-43128,CVE-2026-43130,CVE-2026-43132,CVE-2026-43139,CVE-2026-43145,CVE-2026-43157,CVE-2026-43158,CVE-2026-43161,CVE-2026-43167,CVE-2026-43171,CVE-2026-43175,CVE-2026-43187,CVE-2026-43191,CVE-2026-43194,CVE-2026-43198,CVE-2026-43199,CVE-2026-43205,CVE-2026-43213,CVE-2026-43226,CVE-2026-43233,CVE-2026-43238,CVE-2026-43240,CVE-2026-43248,CVE-2026-43260,CVE-2026-43283,CVE-2026-43284,CVE-2026-43298,CVE-2026-43303,CVE-2026-43336,CVE-2026-43337,CVE-2026-43339,CVE-2026-43345,CVE-2026-43351,CVE-2026-43373,CVE-2026-43374,CVE-2026-43383,CVE-2026-43384,CVE-2026-43386,CVE-2026-43403,CVE-2026-43405,CVE-2026-43406,CVE-2026-43407,CVE-2026-43415,CVE-2026-43449,CVE-2026-43450,CVE-2026-43452,CVE-2026-43456,CVE-2026-43457,CVE-2026-43458,CVE-2026-43465,CVE-2026-43466,C
VE-2026-43468,CVE-2026-43469,CVE-2026-43470,CVE-2026-43471,CVE-2026-43491,CVE-2026-43492,CVE-2026-43502,CVE-2026-45837,CVE-2026-45838,CVE-2026-45840,CVE-2026-45841,CVE-2026-45848,CVE-2026-45857,CVE-2026-45858,CVE-2026-45861,CVE-2026-45862,CVE-2026-45870,CVE-2026-45884,CVE-2026-45888,CVE-2026-45891,CVE-2026-45894,CVE-2026-45899,CVE-2026-45901,CVE-2026-45912,CVE-2026-45920,CVE-2026-45922,CVE-2026-45933,CVE-2026-45940,CVE-2026-45948,CVE-2026-45961,CVE-2026-45964,CVE-2026-45965,CVE-2026-45974,CVE-2026-45983,CVE-2026-45985,CVE-2026-45997,CVE-2026-45999,CVE-2026-46005,CVE-2026-46024,CVE-2026-46037,CVE-2026-46046,CVE-2026-46050,CVE-2026-46051,CVE-2026-46053,CVE-2026-46063,CVE-2026-46065,CVE-2026-46069,CVE-2026-46071,CVE-2026-46076,CVE-2026-46078,CVE-2026-46079,CVE-2026-46091,CVE-2026-46093,CVE-2026-46099,CVE-2026-46101,CVE-2026-46111,CVE-2026-46112,CVE-2026-46116,CVE-2026-46119,CVE-2026-46120,CVE-2026-46124,CVE-2026-46150,CVE-2026-46160,CVE-2026-46161,CVE-2026-46162,CVE-2026-46172,CVE-2026
-46173,CVE-2026-46178,CVE-2026-46185,CVE-2026-46214,CVE-2026-46227,CVE-2026-46242,CVE-2026-46244,CVE-2026-46253,CVE-2026-46254,CVE-2026-46259,CVE-2026-46266,CVE-2026-46289,CVE-2026-46291,CVE-2026-46314,CVE-2026-46319,CVE-2026-46320,CVE-2026-46322,CVE-2026-46328,CVE-2026-46331,CVE-2026-52908,CVE-2026-52909,CVE-2026-52919,CVE-2026-52923,CVE-2026-52924,CVE-2026-52933,CVE-2026-52943,CVE-2026-52954,CVE-2026-52955,CVE-2026-52957,CVE-2026-52962,CVE-2026-52975,CVE-2026-52980,CVE-2026-52993,CVE-2026-53015,CVE-2026-53021,CVE-2026-53036,CVE-2026-53039,CVE-2026-53040,CVE-2026-53041,CVE-2026-53049,CVE-2026-53050,CVE-2026-53053,CVE-2026-53060,CVE-2026-53075,CVE-2026-53078,CVE-2026-53081,CVE-2026-53086,CVE-2026-53090,CVE-2026-53103,CVE-2026-53122,CVE-2026-53133,CVE-2026-53139,CVE-2026-53156,CVE-2026-53167,CVE-2026-53168,CVE-2026-53176,CVE-2026-53178,CVE-2026-53194,CVE-2026-53215,CVE-2026-53216,CVE-2026-53217,CVE-2026-53229,CVE-2026-53249,CVE-2026-53258,CVE-2026-53262,CVE-2026-53263,CVE-2026-53266,
CVE-2026-53272,CVE-2026-53274,CVE-2026-53281,CVE-2026-53285,CVE-2026-53286,CVE-2026-53287,CVE-2026-53306,CVE-2026-53359,CVE-2026-53362
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
- CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit
in br_nf_local_in() after confirm (bsc#1262430).
- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
- CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
- CVE-2026-23394: Revert: 'af_unix: Remove lock dance in unix_peek_fds().' (bsc#1260565).
- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
- CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
(bsc#1267816).
- CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
- CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
- CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
- CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to
initialize tcm_info to zero to prevent an info-leak (bsc#1263996).
- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).
- CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056).
- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
- CVE-2026-43090: xfrm: fix refcount leak in xfrm_migrate_policy_find (bsc#1264250).
- CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).
- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
- CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
- CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
- CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).
- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
- CVE-2026-43145: remoteproc: imx_rproc: Fix invalid loaded resource table detection (bsc#1265091).
- CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
- CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
- CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).
- CVE-2026-43175: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (bsc#1264372).
- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
- CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
- CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
- CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
- CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
- CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
- CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
- CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
- CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
- CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).
- CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF (bsc#1264852).
- CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
- CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).
- CVE-2026-43351: KVM: arm64: gic: Set vgic_model before initing private IRQs (bsc#1265082).
- CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
- CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (bsc#1265084).
- CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
- CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).
- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
- CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls (bsc#1265129).
- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).
- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).
- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).
- CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (bsc#1265123).
- CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
- CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
- CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
- CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).
- CVE-2026-43458: serial: caif: hold tty->link reference in ldisc_open and ser_release (bsc#1265005).
- CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
- CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
- CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).
- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).
- CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (bsc#1264789).
- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).
- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
- CVE-2026-45837: Require (reasonably) normal mappings for MADV_DOFORK (bsc#1266398).
- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).
- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
- CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
- CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773).
- CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put (bsc#1266754).
- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).
- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
- CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer (bsc#1266718).
- CVE-2026-45888: md/raid1: fix memory leak in raid1_run() (bsc#1266761).
- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).
- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).
- CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
- CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path (bsc#1266892).
- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
- CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
- CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805).
- CVE-2026-45933: bpf: Preserve id of register in sync_linked_regs() (bsc#1266693).
- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).
- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).
- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).
- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).
- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).
- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).
- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).
- CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
- CVE-2026-45999: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (bsc#1266750).
- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).
- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).
- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
- CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
- CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
- CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).
- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).
- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).
- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).
- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
- CVE-2026-46093: mm/vmalloc: take vmap_purge_lock in shrinker (bsc#1267548).
- CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).
- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).
- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).
- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).
- CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).
- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
- CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).
- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).
- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).
- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
- CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).
- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).
- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).
- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
- CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).
- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).
- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).
- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).
- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).
- CVE-2026-46291: printk: add print_hex_dump_devel() (bsc#1267937).
- CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).
- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
- CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).
- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).
- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).
- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
- CVE-2026-52919: batman-adv: fix tp_meter counter underflow during shutdown (bsc#1269031).
- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
- CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
- CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).
- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).
- CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).
- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
- CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port->aggregator (bsc#1269234).
- CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities (bsc#1269252).
- CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
- CVE-2026-53015: erofs: unify lcn as u64 for 32-bit platforms (bsc#1269087).
- CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).
- CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).
- CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).
- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).
- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
- CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).
- CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).
- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
- CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).
- CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).
- CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).
- CVE-2026-53081: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (bsc#1269708).
- CVE-2026-53086: net: bcmgenet: move DESC_INDEX flow to ring 0 (bsc#1269537).
- CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
- CVE-2026-53103: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (bsc#1269416).
- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).
- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
- CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).
- CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths (bsc#1269288).
- CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).
- CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).
- CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).
- CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).
- CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).
- CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).
- CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).
- CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691).
- CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).
- CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).
- CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).
- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).
- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
- CVE-2026-53272: erofs: fix use-after-free on sbi->sync_decompress (bsc#1269809).
- CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651).
- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).
- CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527).
- CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths (bsc#1269531).
- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).
- CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).
The following non security issues were fixed:
- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).
- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).
- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).
- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).
- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).
- ACPI: resource: Amend kernel-doc style (git-fixes).
- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).
- ALSA: aloop: Drop superfluous break (git-fixes).
- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).
- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).
- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).
- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).
- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).
- ALSA: gus: check snd_ctl_new1() return value (git-fixes).
- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).
- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).
- ALSA: scarlett2: Allow flash writes ending at segment boundary (git-fixes).
- ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes (stable-fixes).
- ALSA: seq: Clear variable event pointer on read (git-fixes).
- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).
- ALSA: seq: Fix partial userptr event expansion (git-fixes).
- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).
- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).
- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).
- ALSA: timer: Forcibly close timer instances at closing (git-fixes).
- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).
- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).
- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).
- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).
- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).
- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).
- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).
- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).
- ALSA: virtio: Validate control metadata from the device (git-fixes).
- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (bsc#1267600).
- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).
- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (git-fixes).
- ASoC: codecs: aw88261: fix incorrect masks for boost regs (git-fixes).
- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).
- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).
- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).
- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).
- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (git-fixes).
- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).
- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).
- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).
- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).
- ASoC: meson: aiu: Validate written enum values (git-fixes).
- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).
- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).
- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).
- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).
- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).
- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).
- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).
- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).
- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).
- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).
- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).
- Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).
- Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).
- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).
- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).
- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).
- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes).
- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).
- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).
- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).
- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).
- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).
- Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes).
- Bluetooth: hci: validate codec capability element length (git-fixes).
- Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (git-fixes).
- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes).
- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (git-fixes).
- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes).
- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (git-fixes).
- Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).
- Bluetooth: ISO: Fix not using bc_sid as advertisement SID (stable-fixes).
- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).
- Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).
- Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).
- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes).
- Bluetooth: sco: Fix a race condition in sco_sock_timeout() (git-fixes).
- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).
- bnxt_en: Fix NULL pointer dereference (bsc#1268307).
- bpf: Free reuseport cBPF prog after RCU grace period (git-fixes).
- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).
- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).
- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).
- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).
- crypto/hmac: reject keys shorter than 128 bits in fips mode (bsc#1266284 jsc#PED-15986).
- crypto/testmgr: disallow ffdhe2048 in fips mode (bsc#1266284 jsc#PED-15986).
- crypto/testmgr: disallow plain ecb() usage in fips mode (bsc#1266284 jsc#PED-15986).
- crypto/testmgr: disallow sha224 + sha3-224 in fips mode (bsc#1266284 jsc#PED-15986).
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).
- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).
- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).
- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).
- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (git-fixes).
- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (git-fixes).
- crypto: ccp - Do not initialize SNP for SEV ioctls (git-fixes).
- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).
- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).
- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).
- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).
- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).
- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).
- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).
- crypto: hisilicon/qm - disable error report before flr (git-fixes).
- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).
- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).
- crypto: qat - protect service table iterations with service_lock (git-fixes).
- crypto: qat - validate RSA CRT component lengths (git-fixes).
- crypto: rng - Free default RNG on module exit (git-fixes).
- crypto: tegra - Fix dma_free_coherent size error (git-fixes).
- crypto: tegra - fix refcount leak in tegra_se_host1x_submit() (git-fixes).
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (git-fixes).
- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).
- dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (git-fixes).
- dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (git-fixes).
- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).
- dmaengine: Fix possible use after free (git-fixes).
- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).
- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).
- dmaengine: tegra: Fix burst size calculation (git-fixes).
- driver core: reject devices with unregistered buses (git-fixes).
- driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (git-fixes).
- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).
- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).
- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).
- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).
- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).
- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).
- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).
- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).
- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).
- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).
- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).
- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).
- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).
- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).
- drm/amdkfd: always resume_all after suspend_all (git-fixes).
- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).
- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).
- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).
- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).
- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).
- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).
- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).
- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).
- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).
- drm/dp: Add eDP 1.5 bit definition (stable-fixes).
- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).
- drm/gpuvm: Do not prepare NULL objects (git-fixes).
- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).
- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).
- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).
- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).
- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).
- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).
- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).
- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).
- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).
- drm/msm/dp: fix HPD state status bit shift value (git-fixes).
- drm/msm/dp: Fix the ISR_* enum values (git-fixes).
- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).
- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).
- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).
- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).
- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).
- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).
- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).
- drm/rockchip: Test for imported buffers with drm_gem_is_imported() (git-fixes).
- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).
- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).
- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).
- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).
- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).
- drm/vc4: fix krealloc() memory leak (git-fixes).
- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).
- drm/virtio: Fix driver removal with disabled KMS (git-fixes).
- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).
- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).
- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes).
- fbdev: fix use-after-free in store_modes() (stable-fixes).
- fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes).
- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).
- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).
- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).
- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).
- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).
- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).
- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).
- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (bsc#1267600).
- ftrace: Do not over-allocate ftrace memory (bsc#1267600).
- ftrace: Have ftrace pages output reflect freed pages (bsc#1267600).
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (bsc#1267600).
- ftrace: Update the mcount_loc check of skipped entries (bsc#1267600).
- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).
- gpio: mxc: fix irq_high handling (git-fixes).
- gpio: rockchip: convert bank->clk to devm_clk_get_enabled() (git-fixes).
- gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() (git-fixes).
- gpio: zynq: fix runtime PM leak on remove (git-fixes).
- gpiolib: Extract gpiochip_choose_fwnode() for wider use (stable-fixes).
- gpiolib: Remove redundant assignment of return variable (stable-fixes).
- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).
- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes).
- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).
- HID: core: Add printk_ratelimited variants to hid_warn() etc (stable-fixes).
- HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (git-fixes).
- HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).
- HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).
- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).
- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes).
- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).
- HID: rate-limit hid_warn to prevent log flooding (stable-fixes).
- HID: remove duplicate hid_warn_ratelimited definition (git-fixes).
- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).
- HID: wacom: stop hardware after post-start probe failures (git-fixes).
- HID: wiimote: Fix table layout and whitespace errors (git-fixes).
- hv: utils: handle and propagate errors in kvp_register (git-fixes).
- hv: utils: replace deprecated strcpy with strscpy in kvp_register (git-fixes).
- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).
- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (git-fixes).
- hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (git-fixes).
- hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).
- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).
- hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).
- hwmon: (max1619) add missing 'select REGMAP' to Kconfig (git-fixes).
- hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).
- hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).
- hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).
- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).
- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).
- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).
- i2c: core: disable runtime PM on adapter registration failure (git-fixes).
- i2c: core: fix adapter debugfs creation (git-fixes).
- i2c: core: fix adapter deregistration race (git-fixes).
- i2c: core: fix adapter probe deferral loop (git-fixes).
- i2c: core: fix adapter registration race (git-fixes).
- i2c: core: fix hang on adapter registration failure (git-fixes).
- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
- i2c: core: fix NULL-deref on adapter registration failure (git-fixes).
- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).
- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (git-fixes).
- i2c: mpc: Fix timeout calculations (git-fixes).
- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).
- i2c: riic: fix refcount leak in riic_i2c_resume_noirq() (git-fixes).
- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).
- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).
- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).
- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).
- i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock (git-fixes).
- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).
- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).
- iio: adc: ti-ads1298: add bounds check to pga_settings index (stable-fixes).
- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).
- iio: backend: fix uninitialized data in debugfs (git-fixes).
- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).
- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).
- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).
- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).
- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).
- iio: light: opt3001: fix missing state reset on timeout (git-fixes).
- iio: light: si1133: prevent race condition on timeout (git-fixes).
- iio: light: si1133: reset counter to prevent race condition (git-fixes).
- iio: light: veml6030: fix channel type when pushing events (git-fixes).
- iio: light: veml6075: add bounds check to veml6075_it_ms index (stable-fixes).
- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).
- iio: resolver: ad2s1210: notify trigger and clear state on fault read error (git-fixes).
- iio: tcs3472: power down chip on probe failure (git-fixes).
- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check (git-fixes).
- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).
- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).
- Input: elan_i2c - validate firmware size before use (stable-fixes).
- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).
- Input: xpad - add 'Nova 2 Lite' from GameSir (stable-fixes).
- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (git-fixes bsc#1261250).
- io_uring/filetable: clamp alloc_hint to the configured alloc range (git-fixes bsc#1261250).
- io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic (git-fixes bsc#1261250).
- io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250).
- io_uring/wait: fix min_timeout behavior (git-fixes bsc#1261250).
- io_uring/waitid: clear waitid info before copying it to userspace (git-fixes).
- io_uring: fix min_wait wakeups for SQPOLL (git-fixes bsc#1261250).
- ipv4: account for fraggap on the paged allocation path (git-fixes).
- ipv6: account for fraggap on the paged allocation path (git-fixes).
- KEYS: fix overflow in keyctl_pkey_params_get_2() (git-fixes).
- KEYS: Use acquire when reading state in keyring search (git-fixes).
- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).
- KVM: arm64: vgic: Free private_irqs when init fails after allocation (git-fixes).
- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (git-fixes).
- KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (git-fixes).
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).
- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).
- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).
- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (git-fixes).
- KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (git-fixes).
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (git-fixes).
- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (git-fixes).
- KVM: SEV: Add an anonymous 'psc' struct to track current PSC metadata (git-fixes).
- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA (git-fixes).
- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB (git-fixes).
- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (git-fixes).
- KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() (git-fixes).
- KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT (git-fixes).
- KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest (git-fixes).
- KVM: SEV: Return INVALID_INPUT, not MISSING_INPUT, for bad GUEST_REQUEST input(s) (git-fixes).
- KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free (git-fixes).
- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).
- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).
- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).
- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).
- KVM: Use vCPU specific memslots in __kvm_vcpu_map() (git-fixes).
- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).
- KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode (git-fixes).
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).
- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).
- KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall (git-fixes).
- KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest (git-fixes).
- KVM: x86: Consolidate CPUID fault handling for emulator and interception logic (git-fixes).
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).
- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).
- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).
- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).
- KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX (git-fixes).
- KVM: x86: Trace hypercall register *after* truncating values for 32-bit (git-fixes).
- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).
- mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx() (git-fixes).
- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).
- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).
- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).
- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).
- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).
- mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042).
- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).
- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).
- mtd: rawnand: Pause continuous reads at block boundaries (git-fixes).
- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).
- mtd: slram: remove failed entries from the device list (git-fixes).
- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).
- mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program (stable-fixes).
- mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g (stable-fixes).
- mtd: spi-nor: spansion: use die erase for multi-die devices only (git-fixes).
- mtd: spi-nor: swp: Improve locking user experience (git-fixes).
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).
- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).
- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).
- net: mana: Add support for PF device 0x00C1 (bsc#1268237).
- net: mana: Add support for RX CQE Coalescing (bsc#1261256).
- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).
- net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries (bsc#1268238).
- net: mana: Create separate EQs for each vPort (git-fixes).
- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).
- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).
- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).
- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).
- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).
- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).
- net: mana: Sync page pool RX frags for CPU (git-fixes).
- net: mana: Use GIC functions to allocate global EQs (git-fixes).
- net: mana: Validate the packet length reported by the NIC (git-fixes).
- net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes).
- net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).
- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes).
- net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).
- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).
- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).
- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).
- packaging: Add nvidia kernel description.
- packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION.
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562).
- page_pool: Move pp_magic check into helper functions (bsc#1261562).
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).
- PCI: Update saved_config_space upon resource assignment (git-fixes).
- perf/x86/intel/uncore: Fix die ID init and look up bugs (bsc#1267419).
- perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1267419).
- platform/x86: dell-laptop: fix missing cleanups in init error path (git-fixes).
- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).
- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).
- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).
- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).
- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).
- power: supply: core: fix supplied_from allocations (git-fixes).
- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).
- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).
- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).
- ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).
- pwm: imx27: Fix variable truncation in .apply() (git-fixes).
- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).
- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).
- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (git-fixes).
- Revert 'fs: don't block i_writecount during exec' (bsc#1269982).
- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).
- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).
- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).
- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).
- rtc: mpfs: fix counter upload completion condition (git-fixes).
- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).
- scripts/sorttable: Add helper functions for Elf_Ehdr (bsc#1267600).
- scripts/sorttable: Add helper functions for Elf_Shdr (bsc#1267600).
- scripts/sorttable: Add helper functions for Elf_Sym (bsc#1267600).
- scripts/sorttable: Allow matches to functions before function entry (bsc#1267600).
- scripts/sorttable: Always use an array for the mcount_loc sorting (bsc#1267600).
- scripts/sorttable: Convert Elf_Ehdr to union (bsc#1267600).
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (bsc#1267600).
- scripts/sorttable: Fix endianness handling in build-time mcount sort (bsc#1267600).
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (bsc#1267600).
- scripts/sorttable: Have mcount rela sort use direct values (bsc#1267600).
- scripts/sorttable: Have the ORC code use the _r() functions to read (bsc#1267600).
- scripts/sorttable: Make compare_extable() into two functions (bsc#1267600).
- scripts/sorttable: Move code from sorttable.h into sorttable.c (bsc#1267600).
- scripts/sorttable: Remove unneeded Elf_Rel (bsc#1267600).
- scripts/sorttable: Remove unused macro defines (bsc#1267600).
- scripts/sorttable: Remove unused write functions (bsc#1267600).
- scripts/sorttable: Replace Elf_Shdr Macro with a union (bsc#1267600).
- scripts/sorttable: Use a structure of function pointers for elf helpers (bsc#1267600).
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (bsc#1267600).
- scripts/sorttable: Use uint64_t for mcount sorting (bsc#1267600).
- scripts/sorttable: Zero out weak functions in mcount_loc table (bsc#1267600).
- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() (bsc#1257506).
- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).
- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).
- selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
- selftests/bpf: Allow test_progs to link with a partial object set (poo#202224).
- selftests/bpf: Avoid rebuilds when running emit_tests (poo#202224).
- selftests/bpf: Consolidate kernel modules into common directory (poo#202224).
- selftests/bpf: Copy test_kmods when installing selftest (poo#202224).
- selftests/bpf: Fix runqslower cross-endian build (poo#202224).
- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (poo#202224).
- selftests/bpf: make BPF_TARGET_ENDIAN non-recursive to speed up *.bpf.o build (poo#202224).
- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (poo#202224).
- selftests/bpf: Provide weak definitions for cross-test functions (poo#202224).
- selftests/bpf: Skip tests whose objects were not built (poo#202224).
- selftests/bpf: Support cross-endian building (poo#202224).
- selftests/bpf: Tolerate benchmark build failures (poo#202224).
- selftests/bpf: Tolerate BPF and skeleton generation failures (poo#202224).
- selftests/bpf: Tolerate missing files during install (poo#202224).
- selftests/bpf: Tolerate test file compilation failures (poo#202224).
- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).
- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero (git-fixes).
- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (git-fixes).
- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes).
- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes).
- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).
- slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes).
- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes).
- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes).
- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes).
- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() (git-fixes).
- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found (git-fixes).
- spi: at91-usart: drop dead runtime pm support (git-fixes).
- spi: dw: fix wrong BAUDR setting after resume (git-fixes).
- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).
- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).
- spi: hisi-kunpeng: Use dev_err_probe() for host registration failure (git-fixes).
- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).
- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).
- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).
- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).
- Split off kABI workaround for bsc#1267458 (bsc#1267458).
- staging: most: video: avoid double free on video register failure (git-fixes).
- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).
- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).
- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).
- thermal: testing: reject missing command arguments (git-fixes).
- thermal: testing: zone: Flush work items during cleanup (git-fixes).
- thunderbolt: Bound root directory content to block size (git-fixes).
- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).
- thunderbolt: debugfs: Don't stop reading SB registers if just one fails (git-fixes).
- thunderbolt: debugfs: Fix margining error counter buffer leak (git-fixes).
- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).
- thunderbolt: Reject zero-length property entries in validator (git-fixes).
- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).
- tools/power/x86/intel-speed-select: Harden daemon pidfile open (git-fixes).
- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).
- tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (git-fixes).
- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).
- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).
- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).
- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).
- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).
- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (git-fixes).
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).
- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).
- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).
- usb: storage: Add quirks for PNY Elite Portable SSD (git-fixes).
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).
- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (stable-fixes).
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (stable-fixes).
- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).
- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).
- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes).
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).
- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).
- watchdog: apple: Add 'apple,t8103-wdt' compatible (git-fixes).
- watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 (git-fixes).
- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).
- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).
- watchdog: unregister PM notifier on watchdog unregister (git-fixes).
- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).
- wifi: ath11k: fix warning when unbinding (git-fixes).
- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).
- wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).
- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).
- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).
- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).
- wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX (git-fixes).
- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).
- wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).
- wifi: mt76: mt7921: fix a potential scan no APs (stable-fixes).
- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).
- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).
- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer (git-fixes).
- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).
- wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links (git-fixes).
- wifi: mt76: mt7925: keep TX BA state in the primary WCID (git-fixes).
- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).
- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).
- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).
- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).
- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).
- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).
- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).
- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).
- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).
- x86/cpu/amd: Correct the microcode table for Zenbleed (git-fixes).
- x86/cpu: Disable FRED when PTI is forced on (git-fixes).
- x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 (git-fixes).
- x86/cpu: Validate CPUID leaf 0x2 EDX output (git-fixes).
- x86/irq: Ensure initial PIR loads are performed exactly once (git-fixes).
- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16390).
- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16390).
- X.509: Fix validation of ASN.1 certificate header (git-fixes).
- xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276).
-----------------------------------------------------------------
Advisory ID: 1317
Released: Wed Jul 22 09:42:13 2026
Summary: Recommended update for shim
Type: recommended
Severity: important
References: 1269084
This update for shim fixes the following issues:
- shim-install: Improve the detection of SL Micro
* The GRUB_DISTRIBUTOR variable in SL Micro images may contain
'SL Micro' or 'SL-Micro' prefix. (bsc#1269084)
-----------------------------------------------------------------
Advisory ID: 1321
Released: Wed Jul 22 10:44:23 2026
Summary: Security update for perl
Type: security
Severity: important
References: 1266304,1266361,1268349,1271372,1271386,CVE-2025-15649,CVE-2026-12087,CVE-2026-13221,CVE-2026-57432,CVE-2026-8376
This update for perl fixes the following issues:
- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date
(bsc#1266361).
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
(bsc#1266304).
- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure
(bsc#1268349).
- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`
(bsc#1271372).
- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching
(bsc#1271386).
-----------------------------------------------------------------
Advisory ID: 1348
Released: Sat Jul 25 18:36:55 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1271712
This update for openssl-3 fixes the following issue:
- 'HollowByte' DoS via attacker-controlled memory allocation (bsc#1271712).
-----------------------------------------------------------------
Advisory ID: 1390
Released: Wed Jul 29 17:46:03 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes in libpng16:
Version update to 1.6.58 [jsc#PED-16190]
* see CHANGES for other upstream changes
-----------------------------------------------------------------
Advisory ID: 1451
Released: Tue Aug 11 12:14:12 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1259132,1271980
This update for grub2 fixes the following issues:
- Fix crash in booting kernel on some AMD systems (bsc#1271980)
- Add python-base BR
- Fix broken bash completion on arm64 images when the bash-completion package
is not installed (bsc#1259132)
-----------------------------------------------------------------
Advisory ID: 1452
Released: Wed Aug 12 03:09:28 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1185845,1234634,1237449,1243603,1246179,1246182,1247455,1248480,1248611,1251966,1252682,1253262,1253434,1253454,1254306,1255224,1255250,1255441,1255687,1257721,1257777,1258472,1258718,1259329,1259762,1259764,1259866,1259955,1260012,1260347,1260553,1260593,1261250,1261562,1261590,1262160,1262391,1262573,1262602,1262603,1262605,1262614,1262637,1262639,1262640,1262652,1262653,1262655,1262658,1262659,1262663,1262678,1262679,1262723,1262734,1262745,1262746,1262751,1262757,1262768,1262770,1262771,1262992,1262993,1263008,1263010,1263011,1263013,1263014,1263016,1263017,1263020,1263025,1263030,1263031,1263045,1263055,1263059,1263061,1263065,1263073,1263075,1263097,1263111,1263122,1263123,1263124,1263128,1263130,1263134,1263139,1263142,1263145,1263152,1263167,1263170,1263173,1263175,1263491,1263493,1263495,1263539,1263560,1263588,1263591,1263598,1263600,1263657,1263718,1263723,1263776,1263777,1263778,1263780,1263782,1263785,1263786,1263788,1263790,1263797,1263806,1263876,1263879,1
263880,1263904,1263905,1263911,1263917,1263918,1263919,1263921,1263923,1263945,1263975,1263999,1264003,1264006,1264008,1264009,1264013,1264019,1264030,1264032,1264033,1264035,1264039,1264041,1264044,1264048,1264053,1264065,1264070,1264071,1264073,1264074,1264075,1264076,1264079,1264080,1264084,1264087,1264088,1264089,1264090,1264093,1264100,1264101,1264110,1264116,1264117,1264121,1264122,1264124,1264125,1264129,1264137,1264142,1264184,1264188,1264189,1264190,1264197,1264228,1264235,1264237,1264247,1264257,1264267,1264296,1264303,1264308,1264313,1264317,1264319,1264321,1264322,1264331,1264336,1264338,1264339,1264340,1264365,1264377,1264379,1264386,1264387,1264388,1264414,1264416,1264417,1264418,1264419,1264422,1264423,1264424,1264425,1264430,1264431,1264436,1264442,1264446,1264451,1264452,1264473,1264475,1264476,1264477,1264479,1264480,1264482,1264520,1264526,1264530,1264531,1264534,1264537,1264538,1264539,1264540,1264543,1264551,1264553,1264558,1264560,1264562,1264564,1264566,126458
4,1264590,1264592,1264594,1264598,1264600,1264601,1264613,1264615,1264616,1264618,1264620,1264626,1264630,1264631,1264633,1264634,1264637,1264640,1264642,1264644,1264645,1264646,1264647,1264649,1264651,1264668,1264671,1264677,1264678,1264712,1264725,1264731,1264739,1264746,1264748,1264758,1264768,1264779,1264780,1264781,1264782,1264783,1264785,1264788,1264791,1264793,1264795,1264801,1264803,1264805,1264809,1264815,1264816,1264819,1264821,1264822,1264826,1264827,1264830,1264844,1264982,1264987,1264988,1264991,1264993,1265009,1265019,1265032,1265035,1265037,1265041,1265046,1265047,1265054,1265058,1265074,1265078,1265080,1265086,1265089,1265090,1265092,1265093,1265096,1265100,1265101,1265102,1265105,1265122,1265126,1265133,1265138,1265144,1265240,1265247,1265249,1265251,1265254,1265257,1265264,1265449,1265627,1265928,1265999,1266000,1266009,1266393,1266399,1266402,1266411,1266412,1266467,1266468,1266470,1266677,1266679,1266684,1266685,1266688,1266690,1266692,1266694,1266695,1266703,126
6706,1266707,1266712,1266714,1266715,1266716,1266721,1266729,1266730,1266732,1266735,1266736,1266739,1266741,1266743,1266744,1266751,1266755,1266757,1266758,1266762,1266767,1266774,1266775,1266780,1266806,1266813,1266831,1266832,1266834,1266835,1266836,1266839,1266841,1266842,1266846,1266850,1266854,1266855,1266858,1266863,1266864,1266869,1266870,1266872,1266876,1266879,1266880,1266882,1266886,1266890,1266891,1266894,1266896,1266898,1266900,1266904,1266908,1266910,1266913,1266917,1266918,1266920,1266930,1266931,1266932,1266934,1266935,1266939,1266947,1266969,1267021,1267025,1267027,1267198,1267203,1267204,1267209,1267210,1267213,1267222,1267226,1267234,1267236,1267251,1267367,1267371,1267375,1267380,1267381,1267384,1267419,1267432,1267435,1267436,1267439,1267445,1267448,1267449,1267466,1267468,1267470,1267472,1267473,1267479,1267491,1267495,1267496,1267497,1267502,1267524,1267555,1267565,1267567,1267570,1267571,1267583,1267584,1267592,1267594,1267595,1267596,1267597,1267600,1267611,
1267615,1267616,1267621,1267623,1267627,1267629,1267630,1267632,1267636,1267638,1267643,1267646,1267648,1267649,1267651,1267656,1267657,1267658,1267659,1267661,1267662,1267663,1267666,1267667,1267669,1267673,1267676,1267677,1267678,1267680,1267682,1267683,1267689,1267690,1267691,1267693,1267701,1267702,1267704,1267712,1267714,1267715,1267719,1267725,1267726,1267728,1267738,1267918,1267919,1267922,1267927,1267932,1267939,1267943,1267948,1267952,1267953,1267954,1267968,1267983,1267986,1267987,1267990,1267991,1267995,1268024,1268029,1268030,1268031,1268038,1268051,1268220,1268221,1268222,1268223,1268307,1268659,1268966,1268967,1268981,1268983,1268985,1268987,1268994,1269001,1269002,1269003,1269024,1269025,1269027,1269030,1269081,1269090,1269092,1269094,1269095,1269098,1269100,1269104,1269106,1269107,1269111,1269112,1269115,1269116,1269117,1269118,1269119,1269124,1269125,1269131,1269132,1269133,1269138,1269141,1269153,1269154,1269157,1269158,1269166,1269170,1269172,1269174,1269175,12691
77,1269178,1269181,1269184,1269185,1269186,1269187,1269190,1269195,1269198,1269227,1269229,1269232,1269233,1269235,1269236,1269239,1269240,1269241,1269244,1269245,1269254,1269255,1269257,1269258,1269270,1269272,1269273,1269281,1269283,1269286,1269289,1269290,1269304,1269307,1269314,1269318,1269337,1269362,1269364,1269376,1269378,1269383,1269385,1269386,1269391,1269403,1269404,1269410,1269414,1269415,1269505,1269511,1269512,1269513,1269556,1269557,1269574,1269577,1269588,1269637,1269643,1269644,1269652,1269654,1269658,1269659,1269660,1269661,1269663,1269669,1269670,1269672,1269674,1269675,1269677,1269678,1269681,1269682,1269684,1269687,1269688,1269689,1269694,1269709,1269711,1269712,1269713,1269714,1269719,1269722,1269724,1269726,1269727,1269731,1269733,1269734,1269770,1269772,1269773,1269786,1269796,1269797,1269799,1269801,1269808,1269810,1269811,1269817,1269819,1269826,1269877,1269879,1269884,1269886,1269889,1269898,1269899,1269902,1269950,1269961,1269964,1269973,1269976,1269979,12
69984,1269986,1269988,1269990,1269991,1269993,1269994,1269995,1269996,1269997,1269998,1270058,1270059,1270102,1270112,1270113,1270132,1270241,1270244,1270248,1270249,1270257,1270260,1270302,1271290,1271291,1271349,1271366,1271368,1271395,1271526,1271717,1271731,1271813,1271818,1271820,1271825,1271826,1271827,1271830,1271831,1271832,1271833,1271834,1271835,1271858,1271859,1271866,1271869,1271870,1271899,1271904,1271906,1271908,1271912,1271937,1271955,1271964,1271967,1272146,1272150,1272176,1272179,1272180,1272183,1272184,1272187,1272194,1272197,1272204,1272207,1272211,1272242,1272246,1272263,1272268,1272282,1272296,1272359,1272360,1272361,1272362,1272373,1272374,1272380,1272381,1272383,1272384,1272387,1272389,1272406,1272422,1272434,1272462,1272466,1272467,1272468,1272470,1272471,1272472,1272474,1272478,1272480,1272482,1272483,1272489,1272492,1272494,1272499,1272500,1272504,1272505,1272514,1272517,1272522,1272523,1272524,1272568,1272572,1272573,1272578,1272591,1272607,1272610,1272612
,1272613,1272614,1272617,1272618,1272620,1272642,1272646,1272659,1272662,1272664,1272665,1272668,1272670,1272671,1272675,1272678,1272680,1272681,1272682,1272685,1272686,1272689,1272690,1272691,1272693,1272694,1272706,1272781,1272785,1272787,1272797,1272800,1272807,1272836,1272843,1272847,1272848,1272850,1272853,1272858,1272863,1272867,1272871,1272891,1272892,1272897,1272903,1272907,1272920,1272973,1272993,1273005,1273023,1273035,1273044,1273053,1273054,1273117,1273231,1274072,CVE-2023-20585,CVE-2025-38238,CVE-2025-38250,CVE-2025-38469,CVE-2025-38625,CVE-2025-39964,CVE-2025-40022,CVE-2025-40163,CVE-2025-40199,CVE-2025-40216,CVE-2025-54518,CVE-2025-68179,CVE-2025-68204,CVE-2025-71273,CVE-2025-71274,CVE-2025-71286,CVE-2025-71287,CVE-2025-71288,CVE-2025-71291,CVE-2025-71294,CVE-2025-71297,CVE-2025-71305,CVE-2025-71314,CVE-2026-23036,CVE-2026-23052,CVE-2026-23227,CVE-2026-23259,CVE-2026-23276,CVE-2026-23308,CVE-2026-31430,CVE-2026-31431,CVE-2026-31436,CVE-2026-31439,CVE-2026-31440,CVE-20
26-31441,CVE-2026-31442,CVE-2026-31443,CVE-2026-31447,CVE-2026-31462,CVE-2026-31467,CVE-2026-31473,CVE-2026-31474,CVE-2026-31482,CVE-2026-31483,CVE-2026-31485,CVE-2026-31488,CVE-2026-31489,CVE-2026-31497,CVE-2026-31498,CVE-2026-31500,CVE-2026-31509,CVE-2026-31510,CVE-2026-31511,CVE-2026-31512,CVE-2026-31513,CVE-2026-31514,CVE-2026-31520,CVE-2026-31522,CVE-2026-31523,CVE-2026-31524,CVE-2026-31532,CVE-2026-31540,CVE-2026-31542,CVE-2026-31545,CVE-2026-31548,CVE-2026-31549,CVE-2026-31551,CVE-2026-31552,CVE-2026-31557,CVE-2026-31561,CVE-2026-31566,CVE-2026-31570,CVE-2026-31576,CVE-2026-31578,CVE-2026-31581,CVE-2026-31582,CVE-2026-31583,CVE-2026-31585,CVE-2026-31587,CVE-2026-31590,CVE-2026-31591,CVE-2026-31592,CVE-2026-31593,CVE-2026-31595,CVE-2026-31598,CVE-2026-31599,CVE-2026-31602,CVE-2026-31603,CVE-2026-31604,CVE-2026-31605,CVE-2026-31606,CVE-2026-31607,CVE-2026-31615,CVE-2026-31616,CVE-2026-31617,CVE-2026-31618,CVE-2026-31619,CVE-2026-31622,CVE-2026-31623,CVE-2026-31624,CVE-2026-3162
5,CVE-2026-31626,CVE-2026-31627,CVE-2026-31628,CVE-2026-31629,CVE-2026-31651,CVE-2026-31656,CVE-2026-31657,CVE-2026-31659,CVE-2026-31660,CVE-2026-31661,CVE-2026-31667,CVE-2026-31672,CVE-2026-31677,CVE-2026-31687,CVE-2026-31697,CVE-2026-31698,CVE-2026-31699,CVE-2026-31701,CVE-2026-31720,CVE-2026-31721,CVE-2026-31726,CVE-2026-31727,CVE-2026-31728,CVE-2026-31730,CVE-2026-31739,CVE-2026-31740,CVE-2026-31741,CVE-2026-31747,CVE-2026-31748,CVE-2026-31749,CVE-2026-31751,CVE-2026-31754,CVE-2026-31755,CVE-2026-31756,CVE-2026-31758,CVE-2026-31759,CVE-2026-31761,CVE-2026-31762,CVE-2026-31763,CVE-2026-31765,CVE-2026-31767,CVE-2026-31768,CVE-2026-31770,CVE-2026-31772,CVE-2026-31773,CVE-2026-31776,CVE-2026-31778,CVE-2026-31779,CVE-2026-31780,CVE-2026-31781,CVE-2026-43007,CVE-2026-43011,CVE-2026-43017,CVE-2026-43018,CVE-2026-43019,CVE-2026-43020,CVE-2026-43023,CVE-2026-43032,CVE-2026-43033,CVE-2026-43043,CVE-2026-43044,CVE-2026-43046,CVE-2026-43047,CVE-2026-43049,CVE-2026-43051,CVE-2026-43052,CVE-2
026-43056,CVE-2026-43058,CVE-2026-43059,CVE-2026-43061,CVE-2026-43062,CVE-2026-43064,CVE-2026-43069,CVE-2026-43072,CVE-2026-43077,CVE-2026-43079,CVE-2026-43091,CVE-2026-43098,CVE-2026-43104,CVE-2026-43105,CVE-2026-43108,CVE-2026-43110,CVE-2026-43111,CVE-2026-43113,CVE-2026-43114,CVE-2026-43117,CVE-2026-43118,CVE-2026-43120,CVE-2026-43123,CVE-2026-43126,CVE-2026-43129,CVE-2026-43133,CVE-2026-43134,CVE-2026-43135,CVE-2026-43136,CVE-2026-43137,CVE-2026-43138,CVE-2026-43140,CVE-2026-43141,CVE-2026-43143,CVE-2026-43147,CVE-2026-43152,CVE-2026-43156,CVE-2026-43159,CVE-2026-43162,CVE-2026-43168,CVE-2026-43169,CVE-2026-43170,CVE-2026-43172,CVE-2026-43177,CVE-2026-43180,CVE-2026-43182,CVE-2026-43183,CVE-2026-43189,CVE-2026-43196,CVE-2026-43200,CVE-2026-43202,CVE-2026-43203,CVE-2026-43204,CVE-2026-43206,CVE-2026-43207,CVE-2026-43211,CVE-2026-43214,CVE-2026-43216,CVE-2026-43218,CVE-2026-43220,CVE-2026-43221,CVE-2026-43222,CVE-2026-43223,CVE-2026-43225,CVE-2026-43229,CVE-2026-43230,CVE-2026-432
31,CVE-2026-43232,CVE-2026-43236,CVE-2026-43240,CVE-2026-43241,CVE-2026-43242,CVE-2026-43243,CVE-2026-43244,CVE-2026-43246,CVE-2026-43249,CVE-2026-43250,CVE-2026-43251,CVE-2026-43253,CVE-2026-43255,CVE-2026-43256,CVE-2026-43257,CVE-2026-43261,CVE-2026-43262,CVE-2026-43264,CVE-2026-43266,CVE-2026-43269,CVE-2026-43270,CVE-2026-43273,CVE-2026-43275,CVE-2026-43276,CVE-2026-43277,CVE-2026-43278,CVE-2026-43279,CVE-2026-43281,CVE-2026-43287,CVE-2026-43291,CVE-2026-43293,CVE-2026-43295,CVE-2026-43296,CVE-2026-43297,CVE-2026-43300,CVE-2026-43302,CVE-2026-43304,CVE-2026-43306,CVE-2026-43307,CVE-2026-43308,CVE-2026-43309,CVE-2026-43312,CVE-2026-43313,CVE-2026-43314,CVE-2026-43316,CVE-2026-43318,CVE-2026-43319,CVE-2026-43320,CVE-2026-43324,CVE-2026-43327,CVE-2026-43330,CVE-2026-43334,CVE-2026-43340,CVE-2026-43342,CVE-2026-43343,CVE-2026-43344,CVE-2026-43346,CVE-2026-43352,CVE-2026-43353,CVE-2026-43354,CVE-2026-43357,CVE-2026-43368,CVE-2026-43370,CVE-2026-43380,CVE-2026-43381,CVE-2026-43382,CVE-
2026-43387,CVE-2026-43395,CVE-2026-43397,CVE-2026-43412,CVE-2026-43413,CVE-2026-43424,CVE-2026-43425,CVE-2026-43426,CVE-2026-43427,CVE-2026-43428,CVE-2026-43429,CVE-2026-43430,CVE-2026-43432,CVE-2026-43436,CVE-2026-43437,CVE-2026-43440,CVE-2026-43443,CVE-2026-43444,CVE-2026-43445,CVE-2026-43451,CVE-2026-43459,CVE-2026-43467,CVE-2026-43472,CVE-2026-43473,CVE-2026-43475,CVE-2026-43476,CVE-2026-43480,CVE-2026-43481,CVE-2026-43483,CVE-2026-43486,CVE-2026-43487,CVE-2026-43488,CVE-2026-43493,CVE-2026-43495,CVE-2026-43496,CVE-2026-43501,CVE-2026-45834,CVE-2026-45835,CVE-2026-45839,CVE-2026-45845,CVE-2026-45849,CVE-2026-45851,CVE-2026-45853,CVE-2026-45859,CVE-2026-45863,CVE-2026-45865,CVE-2026-45866,CVE-2026-45867,CVE-2026-45868,CVE-2026-45869,CVE-2026-45871,CVE-2026-45872,CVE-2026-45873,CVE-2026-45874,CVE-2026-45875,CVE-2026-45877,CVE-2026-45878,CVE-2026-45879,CVE-2026-45880,CVE-2026-45881,CVE-2026-45882,CVE-2026-45883,CVE-2026-45885,CVE-2026-45895,CVE-2026-45900,CVE-2026-45902,CVE-2026-45
904,CVE-2026-45905,CVE-2026-45911,CVE-2026-45913,CVE-2026-45915,CVE-2026-45916,CVE-2026-45917,CVE-2026-45921,CVE-2026-45923,CVE-2026-45925,CVE-2026-45928,CVE-2026-45930,CVE-2026-45936,CVE-2026-45938,CVE-2026-45941,CVE-2026-45944,CVE-2026-45946,CVE-2026-45947,CVE-2026-45950,CVE-2026-45954,CVE-2026-45958,CVE-2026-45963,CVE-2026-45969,CVE-2026-45973,CVE-2026-45976,CVE-2026-45981,CVE-2026-45982,CVE-2026-45986,CVE-2026-45987,CVE-2026-45994,CVE-2026-45996,CVE-2026-46001,CVE-2026-46003,CVE-2026-46004,CVE-2026-46006,CVE-2026-46009,CVE-2026-46011,CVE-2026-46015,CVE-2026-46016,CVE-2026-46018,CVE-2026-46019,CVE-2026-46023,CVE-2026-46026,CVE-2026-46027,CVE-2026-46033,CVE-2026-46034,CVE-2026-46036,CVE-2026-46038,CVE-2026-46040,CVE-2026-46048,CVE-2026-46049,CVE-2026-46056,CVE-2026-46058,CVE-2026-46059,CVE-2026-46060,CVE-2026-46064,CVE-2026-46068,CVE-2026-46073,CVE-2026-46074,CVE-2026-46075,CVE-2026-46077,CVE-2026-46080,CVE-2026-46082,CVE-2026-46084,CVE-2026-46086,CVE-2026-46088,CVE-2026-46089,CVE
-2026-46092,CVE-2026-46096,CVE-2026-46102,CVE-2026-46103,CVE-2026-46108,CVE-2026-46109,CVE-2026-46113,CVE-2026-46117,CVE-2026-46121,CVE-2026-46122,CVE-2026-46123,CVE-2026-46125,CVE-2026-46126,CVE-2026-46127,CVE-2026-46128,CVE-2026-46130,CVE-2026-46131,CVE-2026-46132,CVE-2026-46136,CVE-2026-46137,CVE-2026-46138,CVE-2026-46140,CVE-2026-46143,CVE-2026-46144,CVE-2026-46145,CVE-2026-46146,CVE-2026-46147,CVE-2026-46149,CVE-2026-46151,CVE-2026-46152,CVE-2026-46157,CVE-2026-46158,CVE-2026-46163,CVE-2026-46165,CVE-2026-46166,CVE-2026-46167,CVE-2026-46168,CVE-2026-46170,CVE-2026-46174,CVE-2026-46177,CVE-2026-46179,CVE-2026-46180,CVE-2026-46184,CVE-2026-46186,CVE-2026-46187,CVE-2026-46189,CVE-2026-46190,CVE-2026-46191,CVE-2026-46193,CVE-2026-46197,CVE-2026-46198,CVE-2026-46199,CVE-2026-46200,CVE-2026-46201,CVE-2026-46204,CVE-2026-46205,CVE-2026-46206,CVE-2026-46207,CVE-2026-46209,CVE-2026-46211,CVE-2026-46212,CVE-2026-46216,CVE-2026-46218,CVE-2026-46219,CVE-2026-46220,CVE-2026-46225,CVE-2026-4
6226,CVE-2026-46229,CVE-2026-46230,CVE-2026-46231,CVE-2026-46232,CVE-2026-46233,CVE-2026-46234,CVE-2026-46235,CVE-2026-46236,CVE-2026-46238,CVE-2026-46241,CVE-2026-46245,CVE-2026-46246,CVE-2026-46247,CVE-2026-46249,CVE-2026-46252,CVE-2026-46255,CVE-2026-46261,CVE-2026-46263,CVE-2026-46265,CVE-2026-46267,CVE-2026-46270,CVE-2026-46273,CVE-2026-46274,CVE-2026-46275,CVE-2026-46276,CVE-2026-46282,CVE-2026-46283,CVE-2026-46285,CVE-2026-46286,CVE-2026-46287,CVE-2026-46292,CVE-2026-46294,CVE-2026-46296,CVE-2026-46301,CVE-2026-46306,CVE-2026-46307,CVE-2026-46312,CVE-2026-46313,CVE-2026-46315,CVE-2026-46321,CVE-2026-46323,CVE-2026-46324,CVE-2026-46326,CVE-2026-46327,CVE-2026-46329,CVE-2026-52904,CVE-2026-52910,CVE-2026-52913,CVE-2026-52915,CVE-2026-52916,CVE-2026-52918,CVE-2026-52921,CVE-2026-52922,CVE-2026-52925,CVE-2026-52926,CVE-2026-52927,CVE-2026-52930,CVE-2026-52934,CVE-2026-52936,CVE-2026-52937,CVE-2026-52941,CVE-2026-52942,CVE-2026-52947,CVE-2026-52948,CVE-2026-52951,CVE-2026-52953,CV
E-2026-52956,CVE-2026-52958,CVE-2026-52959,CVE-2026-52963,CVE-2026-52964,CVE-2026-52967,CVE-2026-52969,CVE-2026-52970,CVE-2026-52972,CVE-2026-52974,CVE-2026-52976,CVE-2026-52981,CVE-2026-52982,CVE-2026-52984,CVE-2026-52986,CVE-2026-52988,CVE-2026-52989,CVE-2026-52995,CVE-2026-52998,CVE-2026-52999,CVE-2026-53000,CVE-2026-53002,CVE-2026-53003,CVE-2026-53004,CVE-2026-53005,CVE-2026-53006,CVE-2026-53009,CVE-2026-53011,CVE-2026-53012,CVE-2026-53013,CVE-2026-53014,CVE-2026-53016,CVE-2026-53022,CVE-2026-53032,CVE-2026-53035,CVE-2026-53037,CVE-2026-53038,CVE-2026-53045,CVE-2026-53047,CVE-2026-53051,CVE-2026-53052,CVE-2026-53056,CVE-2026-53058,CVE-2026-53062,CVE-2026-53063,CVE-2026-53064,CVE-2026-53065,CVE-2026-53066,CVE-2026-53068,CVE-2026-53069,CVE-2026-53070,CVE-2026-53071,CVE-2026-53072,CVE-2026-53073,CVE-2026-53074,CVE-2026-53080,CVE-2026-53082,CVE-2026-53083,CVE-2026-53084,CVE-2026-53085,CVE-2026-53088,CVE-2026-53093,CVE-2026-53097,CVE-2026-53098,CVE-2026-53099,CVE-2026-53101,CVE-2026-
53102,CVE-2026-53104,CVE-2026-53105,CVE-2026-53106,CVE-2026-53107,CVE-2026-53112,CVE-2026-53113,CVE-2026-53121,CVE-2026-53123,CVE-2026-53131,CVE-2026-53132,CVE-2026-53134,CVE-2026-53135,CVE-2026-53136,CVE-2026-53137,CVE-2026-53138,CVE-2026-53140,CVE-2026-53143,CVE-2026-53144,CVE-2026-53146,CVE-2026-53147,CVE-2026-53148,CVE-2026-53149,CVE-2026-53150,CVE-2026-53152,CVE-2026-53157,CVE-2026-53158,CVE-2026-53159,CVE-2026-53160,CVE-2026-53161,CVE-2026-53175,CVE-2026-53177,CVE-2026-53181,CVE-2026-53182,CVE-2026-53183,CVE-2026-53184,CVE-2026-53185,CVE-2026-53186,CVE-2026-53189,CVE-2026-53190,CVE-2026-53191,CVE-2026-53192,CVE-2026-53193,CVE-2026-53195,CVE-2026-53196,CVE-2026-53199,CVE-2026-53202,CVE-2026-53203,CVE-2026-53205,CVE-2026-53208,CVE-2026-53209,CVE-2026-53210,CVE-2026-53212,CVE-2026-53213,CVE-2026-53214,CVE-2026-53218,CVE-2026-53221,CVE-2026-53224,CVE-2026-53225,CVE-2026-53226,CVE-2026-53227,CVE-2026-53230,CVE-2026-53233,CVE-2026-53235,CVE-2026-53236,CVE-2026-53237,CVE-2026-53239,C
VE-2026-53241,CVE-2026-53242,CVE-2026-53245,CVE-2026-53246,CVE-2026-53247,CVE-2026-53250,CVE-2026-53251,CVE-2026-53252,CVE-2026-53253,CVE-2026-53254,CVE-2026-53255,CVE-2026-53256,CVE-2026-53260,CVE-2026-53265,CVE-2026-53267,CVE-2026-53268,CVE-2026-53270,CVE-2026-53273,CVE-2026-53275,CVE-2026-53277,CVE-2026-53279,CVE-2026-53289,CVE-2026-53293,CVE-2026-53297,CVE-2026-53313,CVE-2026-53317,CVE-2026-53318,CVE-2026-53321,CVE-2026-53324,CVE-2026-53325,CVE-2026-53329,CVE-2026-53331,CVE-2026-53332,CVE-2026-53339,CVE-2026-53345,CVE-2026-53347,CVE-2026-53350,CVE-2026-53355,CVE-2026-53356,CVE-2026-53357,CVE-2026-53358,CVE-2026-53359,CVE-2026-53360,CVE-2026-53366,CVE-2026-53369,CVE-2026-53374,CVE-2026-53375,CVE-2026-53376,CVE-2026-53379,CVE-2026-53381,CVE-2026-53382,CVE-2026-53385,CVE-2026-53386,CVE-2026-53387,CVE-2026-53388,CVE-2026-53391,CVE-2026-53392,CVE-2026-53393,CVE-2026-53394,CVE-2026-53397,CVE-2026-53398,CVE-2026-53399,CVE-2026-53400,CVE-2026-53402,CVE-2026-53403,CVE-2026-63794,CVE-2026
-63795,CVE-2026-63802,CVE-2026-63806,CVE-2026-63807,CVE-2026-63809,CVE-2026-63821,CVE-2026-63822,CVE-2026-63824,CVE-2026-63826,CVE-2026-63827,CVE-2026-63829,CVE-2026-63831,CVE-2026-63836,CVE-2026-63842,CVE-2026-63843,CVE-2026-63844,CVE-2026-63845,CVE-2026-63846,CVE-2026-63847,CVE-2026-63848,CVE-2026-63850,CVE-2026-63851,CVE-2026-63852,CVE-2026-63853,CVE-2026-63854,CVE-2026-63855,CVE-2026-63856,CVE-2026-63861,CVE-2026-63862,CVE-2026-63869,CVE-2026-63871,CVE-2026-63875,CVE-2026-63882,CVE-2026-63883,CVE-2026-63884,CVE-2026-63886,CVE-2026-63892,CVE-2026-63893,CVE-2026-63894,CVE-2026-63895,CVE-2026-63896,CVE-2026-63897,CVE-2026-63899,CVE-2026-63900,CVE-2026-63902,CVE-2026-63903,CVE-2026-63904,CVE-2026-63905,CVE-2026-63908,CVE-2026-63912,CVE-2026-63915,CVE-2026-63916,CVE-2026-63919,CVE-2026-63923,CVE-2026-63927,CVE-2026-63928,CVE-2026-63929,CVE-2026-63930,CVE-2026-63931,CVE-2026-63933,CVE-2026-63934,CVE-2026-63936,CVE-2026-63937,CVE-2026-63938,CVE-2026-63939,CVE-2026-63940,CVE-2026-63942,
CVE-2026-63943,CVE-2026-63944,CVE-2026-63945,CVE-2026-63946,CVE-2026-63947,CVE-2026-63948,CVE-2026-63949,CVE-2026-63952,CVE-2026-63957,CVE-2026-63958,CVE-2026-63959,CVE-2026-63960,CVE-2026-63961,CVE-2026-63962,CVE-2026-63963,CVE-2026-63964,CVE-2026-63967,CVE-2026-63968,CVE-2026-63971,CVE-2026-63972,CVE-2026-63973,CVE-2026-63974,CVE-2026-63975,CVE-2026-63976,CVE-2026-63991,CVE-2026-63994,CVE-2026-64018,CVE-2026-64021,CVE-2026-64025,CVE-2026-64034,CVE-2026-64061,CVE-2026-64091,CVE-2026-64106,CVE-2026-64157,CVE-2026-64158,CVE-2026-64174,CVE-2026-64182,CVE-2026-64183,CVE-2026-64187,CVE-2026-64188,CVE-2026-64189,CVE-2026-64191,CVE-2026-64220,CVE-2026-64221,CVE-2026-64223,CVE-2026-64231,CVE-2026-64233,CVE-2026-64234,CVE-2026-64241,CVE-2026-64242,CVE-2026-64330,CVE-2026-64336,CVE-2026-64345,CVE-2026-64347,CVE-2026-64357,CVE-2026-64465,CVE-2026-64528,CVE-2026-64530,CVE-2026-64560,CVE-2026-64561,CVE-2026-64564,CVE-2026-64600
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).
- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).
- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).
- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).
- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).
- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).
- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).
- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).
- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).
- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).
- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).
- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).
- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).
- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).
- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).
- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).
- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).
- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).
- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).
- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).
- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).
- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).
- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).
- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).
- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).
- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).
- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).
- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).
- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).
- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).
- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).
- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).
- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).
- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).
- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).
- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).
- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).
- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).
- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).
- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).
- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).
- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).
- CVE-2026-52941: net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (bsc#1268966).
- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).
- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).
- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).
- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).
- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).
- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).
- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).
- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).
- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).
- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).
- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).
- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).
- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).
- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).
- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).
- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).
- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).
- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).
- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).
- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).
- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).
- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).
- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir
(bsc#1269092).
- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).
- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).
- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).
- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).
- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).
- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).
- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).
- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).
- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).
- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).
- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).
- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).
- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).
- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).
- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).
- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).
- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).
- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).
- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).
- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).
- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).
- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).
- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).
- CVE-2026-53184: udp: clear skb->dev before running a sockmap verdict (bsc#1269689).
- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).
- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).
- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).
- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).
- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).
- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).
- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).
- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).
- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).
- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).
- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).
- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).
- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).
- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).
- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).
- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).
- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).
- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).
- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).
- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).
- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).
- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).
- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).
- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).
- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).
- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).
- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).
- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).
- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).
- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).
- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).
- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).
- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).
- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).
- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).
- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).
- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).
- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).
- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).
- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).
- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).
- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).
- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).
- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).
- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).
- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).
- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).
- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).
- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).
- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).
- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).
- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).
- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).
- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).
- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).
- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).
- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).
The following non security issues were fixed:
- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).
- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).
- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).
- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).
- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).
- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).
- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).
- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).
- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).
- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).
- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).
- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).
- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).
- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).
- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).
- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).
- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).
- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).
- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).
- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).
- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).
- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).
- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).
- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).
- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).
- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).
- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).
- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).
- ASoC: tas2562: fix DVC coefficient write order (git-fixes).
- ASoC: tas2781: bound firmware description string parsing (git-fixes).
- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).
- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).
- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).
- batman-adv: dat: fix tie-break for candidate selection (git-fixes).
- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
- batman-adv: fix VLAN priority offset (git-fixes).
- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).
- batman-adv: frag: free unfragmentable packet (git-fixes).
- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).
- batman-adv: tt: avoid request storms during pending request (git-fixes).
- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).
- bitops: use common function parameter names (git-fixes).
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (git-fixes).
- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).
- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).
- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).
- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).
- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).
- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).
- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).
- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).
- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).
- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).
- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).
- Bluetooth: HIDP: validate numbered report payloads (git-fixes).
- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).
- Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (git-fixes).
- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).
- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).
- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).
- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).
- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).
- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).
- btrfs: do not trim a device which is not writeable (bsc#1272568).
- bus: sunxi-rsb: Always check register address validity (git-fixes).
- can: bcm: add missing rcu list annotations and operations (git-fixes).
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).
- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).
- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).
- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).
- can: ctucanfd: handle bus error interrupts (git-fixes).
- can: ctucanfd: mark error-active controller status valid (git-fixes).
- can: ctucanfd: unmap BAR0 using base address (git-fixes).
- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).
- can: ems_usb: validate CPC message lengths (git-fixes).
- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).
- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).
- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).
- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).
- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).
- can: peak_usb: add bounds check for USB channel index (git-fixes).
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).
- can: peak_usb: validate uCAN receive record lengths (git-fixes).
- can: softing: fw_parse(): validate firmware record spans (git-fixes).
- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).
- comedi: comedi_parport: deal with premature interrupt (git-fixes).
- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).
- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).
- crypto: qat - keep VFs enabled during reset (stable-fixes).
- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).
- dm cache policy smq: check allocation under invalidate lock (git-fixes).
- dm cache: fix missing return in invalidate_committed's error path (git-fixes).
- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).
- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).
- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).
- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).
- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).
- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).
- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).
- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).
- drm/amd/display: set new_stream to NULL after release (git-fixes).
- drm/amd/display: use proper context for logging (git-fixes).
- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).
- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).
- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).
- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).
- drm/amdgpu: fix aperture mapping leak (git-fixes).
- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).
- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).
- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).
- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).
- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).
- drm/gfx10: Program DB_RING_CONTROL (git-fixes).
- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).
- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).
- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).
- drm/i915/gt: use correct selftest config symbol (git-fixes).
- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).
- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).
- drm/i915: Return NULL on error in active_instance (git-fixes).
- drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM (git-fixes).
- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).
- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).
- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).
- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).
- drm/mediatek: Check CRTC state before freeing (git-fixes).
- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).
- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).
- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).
- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).
- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).
- drm/panthor: reject firmware sections with oversized data (git-fixes).
- drm/panthor: return error on truncated firmware (git-fixes).
- drm/panthor: validate firmware interface structure sizes (git-fixes).
- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).
- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).
- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).
- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).
- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).
- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).
- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).
- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).
- drm/virtio: bound EDID block reads to the response buffer (git-fixes).
- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).
- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).
- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).
- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).
- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).
- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).
- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).
- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).
- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).
- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).
- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).
- drm/xe: remove duplicate <kunit/test-bug.h> include (git-fixes).
- erofs: set fileio bio failed in short read case (git-fixes).
- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).
- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).
- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).
- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).
- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).
- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).
- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).
- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).
- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).
- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).
- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).
- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).
- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).
- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).
- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).
- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).
- firewire: net: Fix fragmented datagram reassembly (git-fixes).
- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).
- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).
- gpio-f7188x: Add support for NCT6126D version B (git-fixes).
- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).
- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).
- gpio: htc-egpio: use managed gpiochip registration (git-fixes).
- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).
- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).
- gpio: mvebu: free generic chips on unbind (git-fixes).
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).
- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).
- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).
- gpio: rockchip: teardown bugs and resource leaks (git-fixes).
- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).
- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).
- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
- gpios: palmas: add .get_direction() op (git-fixes).
- HID: add haptics page defines (stable-fixes).
- HID: hid-sjoy: race between init and usage (git-fixes).
- HID: pidff: Add missing spaces (stable-fixes).
- HID: pidff: Fix missing blank lines after declarations (stable-fixes).
- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).
- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).
- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).
- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).
- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).
- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).
- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).
- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).
- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).
- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).
- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).
- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).
- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).
- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).
- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).
- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).
- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).
- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).
- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).
- hwmon: (sht3x) Fix unaligned accesses (git-fixes).
- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).
- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).
- hwmon: occ: validate poll response sensor blocks (git-fixes).
- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).
- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).
- i2c: imx: Fix slave registration race and error handling (git-fixes).
- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).
- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).
- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).
- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).
- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).
- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).
- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).
- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).
- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).
- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).
- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).
- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).
- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).
- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).
- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).
- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).
- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).
- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).
- iio: event: Fix event FIFO reset race (git-fixes).
- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).
- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).
- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).
- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).
- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).
- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).
- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).
- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).
- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).
- Input: ads7846 - restore half-duplex support (git-fixes).
- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).
- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).
- Input: goodix - clamp the device-reported contact count (git-fixes).
- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).
- Input: ims-pcu - add response length checks (git-fixes).
- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).
- Input: ims-pcu - fix firmware leak in async update (git-fixes).
- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).
- Input: ims-pcu - fix logic error in packet reset (git-fixes).
- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).
- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).
- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).
- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).
- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).
- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).
- Input: ims-pcu - release data interface on disconnect (git-fixes).
- Input: ims-pcu - validate control endpoint type (git-fixes).
- Input: maple_keyb - set driver data before registering input device (stable-fixes).
- Input: maplecontrol - set driver data before registering input device (stable-fixes).
- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).
- Input: maplemouse - set driver data before registering input device (stable-fixes).
- Input: mms114 - fix multi-touch slot corruption (git-fixes).
- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).
- Input: mms114 - reject an oversized device packet size (git-fixes).
- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).
- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).
- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).
- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).
- Input: rmi4 - fix register descriptor address calculation (git-fixes).
- Input: rmi4 - fix type overflow in register counts (git-fixes).
- Input: rmi4 - initialize attn_fifo properly (stable-fixes).
- Input: rmi4 - iterative IRQ handler (git-fixes).
- Input: rmi4 - refactor F12 probe function (stable-fixes).
- Input: rmi4 - refactor function allocation and registration (stable-fixes).
- Input: rmi4 - refactor register descriptor parsing (git-fixes).
- Input: rmi4 - tolerate short register descriptor structure (git-fixes).
- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).
- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).
- Input: touchwin - reset the packet index on every complete packet (git-fixes).
- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).
- intel_th: fix MSC output device reference leak (git-fixes).
- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).
- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).
- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).
- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).
- io_uring/net: always use current transfer count for buffer put (git-fixes).
- io_uring/net: improve recv bundles (bsc#1271290).
- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).
- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).
- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).
- io_uring/timeout: add helper for parsing user time (bsc#1271291).
- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).
- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).
- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).
- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).
- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).
- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).
- KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT (git-fixes).
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).
- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).
- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).
- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).
- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).
- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).
- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).
- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).
- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).
- leds: uleds: Fix potential buffer overread (git-fixes).
- mac802154: hold an interface reference across the scan worker (git-fixes).
- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).
- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).
- mac802154: remove interfaces with RCU list deletion (git-fixes).
- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).
- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).
- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).
- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).
- media: cec: seco: unregister adapter on IR probe failure (git-fixes).
- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).
- media: cedrus: Fix missing cleanup in error path (git-fixes).
- media: cedrus: skip invalid H.264 reference list entries (git-fixes).
- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).
- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).
- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).
- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).
- media: pci: dm1105: Free allocated workqueue (git-fixes).
- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).
- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).
- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).
- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).
- media: rockchip: rga: fix too small buffer size (git-fixes).
- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).
- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).
- media: uvcvideo: Avoid partial metadata buffers (git-fixes).
- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).
- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).
- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).
- media: uvcvideo: Fix sequence number when no EOF (git-fixes).
- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).
- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).
- media: v4l2-common: Add YUV24 format info (git-fixes).
- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).
- media: vidtv: fix reference leak on failed device registration (git-fixes).
- media: vimc: fix reference leak on failed device registration (git-fixes).
- media: vpif_capture: fix OF node reference imbalance (git-fixes).
- mei: bus: access mei_device under device_lock on cleanup (git-fixes).
- memory: tegra: Wire up system sleep PM ops (git-fixes).
- memstick: ms_block: reject a card that reports too many blocks (git-fixes).
- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).
- mfd: cs42l43: Sanity check firmware size (git-fixes).
- mfd: rsmu: Fix page register setup (git-fixes).
- mfd: sm501: Fix reference leak on failed device registration (git-fixes).
- mfd: tps6586x: Fix OF node refcount (git-fixes).
- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).
- misc: nsm: pin the module while the device is open (git-fixes).
- mkspec-dtb: Skip missing DTBs.
- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).
- mmc: block: fix RPMB device unregister ordering (git-fixes).
- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).
- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).
- mshv: fix hv_input_get_system_property struct (git-fixes).
- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).
- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).
- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).
- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).
- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).
- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).
- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).
- net: mana: Add Interrupt Moderation support (bsc#1271368).
- net: mana: Return error code from mana_create_rxq() (git-fixes).
- net: mctp i2c: Copy headers if cloned (bsc#1266694).
- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).
- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).
- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).
- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).
- net: wwan: t7xx: check skb_clone in control TX (git-fixes).
- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).
- netfs: Defer the emission of trace_netfs_folio() (git-fixes).
- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).
- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).
- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).
- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).
- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).
- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).
- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).
- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).
- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).
- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).
- pinctrl: equilibrium: fix warning trace on load (git-fixes).
- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).
- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).
- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).
- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).
- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).
- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).
- pkspec-dtb: Fix dtb-al rename.
- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).
- platform/x86/amd/pmc: Avoid logging '(null)' for DMI values (git-fixes).
- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).
- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).
- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).
- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).
- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).
- posix-timers: Add proper state tracking (bsc#1271912).
- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).
- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).
- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).
- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).
- power: supply: max17040: handle missing status supplier (git-fixes).
- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).
- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).
- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).
- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).
- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).
- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).
- Revert 'Input: rmi4 - fix register descriptor address calculation' (stable-fixes).
- sctp: validate embedded address parameter length (git-fixes).
- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).
- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).
- selftests: Replace sleep with slowwait (bsc#1272871).
- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).
- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).
- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).
- serial: msm: Disable DMA for kernel console UART (git-fixes).
- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).
- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).
- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).
- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).
- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).
- spi: sh-msiof: abort transfers when reset times out (git-fixes).
- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).
- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).
- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).
- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).
- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).
- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).
- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).
- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).
- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).
- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).
- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).
- thermal: core: Free thermal zone ID later during removal (git-fixes).
- time: Switch to hrtimer_setup() (bsc#1271912).
- tpm: Make the TPM character devices non-seekable (git-fixes).
- uio_hv_generic: Bind to FCopy device by default (git-fixes).
- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).
- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).
- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).
- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).
- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).
- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).
- usb: free iso schedules on failed submit (git-fixes).
- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).
- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).
- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).
- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).
- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).
- usb: gadget: f_printer: take kref only for successful open (git-fixes).
- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).
- usb: gadget: function: rndis: add length check for header (stable-fixes).
- usb: gadget: function: rndis: add length check to response query (stable-fixes).
- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).
- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).
- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).
- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).
- USB: idmouse: fix use-after-free on disconnect race (git-fixes).
- USB: iowarrior: fix use-after-free on disconnect (git-fixes).
- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).
- usb: iowarrior: remove inherent race with minor number (stable-fixes).
- USB: ldusb: fix use-after-free on disconnect race (git-fixes).
- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).
- USB: misc: uss720: unregister parport on probe failure (git-fixes).
- usb: mtu3: unmap request DMA on queue failure (git-fixes).
- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).
- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).
- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).
- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).
- USB: serial: io_edgeport: cap received transmit credits (git-fixes).
- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).
- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).
- USB: serial: keyspan_pda: fix information leak (git-fixes).
- USB: serial: mxuport: validate firmware header size (git-fixes).
- USB: serial: option: add MeiG SRM813Q (stable-fixes).
- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).
- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).
- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).
- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).
- usb: typec: class: drop PD lookup reference (git-fixes).
- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).
- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).
- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).
- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).
- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).
- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).
- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).
- USB: ulpi: fix memory leak on registration failure (git-fixes).
- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).
- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).
- usbip: tools: support SuperSpeedPlus devices (git-fixes).
- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).
- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).
- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).
- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).
- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).
- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).
- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).
- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).
- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).
- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).
- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).
- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).
- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).
- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).
- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).
- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).
- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).
- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).
- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).
- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).
- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).
- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).
- wifi: mac80211: tear down new links on vif update error path (git-fixes).
- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).
- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).
- wifi: mt76: Disable napi when removing device (git-fixes).
- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).
- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).
- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).
- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).
- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).
- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).
- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).
- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).
- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).
- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).
- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).
- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).
- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).
- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).
- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).
- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).
- xfs: only assert new size for datafork during truncate extents (bsc#1264084).
- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).
- xfs: rework datasync tracking and execution (bsc#1237449).
- xhci: dbgtty: fix device unregister (git-fixes).
- xhci: dbgtty: fix device unregister: fixup (git-fixes).
-----------------------------------------------------------------
Advisory ID: 1529
Released: Thu Aug 27 14:47:41 2026
Summary: Security update for gzip
Type: security
Severity: moderate
References: 1269623,1272554,CVE-2026-41992
This update for gzip fixes the following issues:
- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state
between different decompression formats within a single execution (bsc#1269623, bsc#1272554).
-----------------------------------------------------------------
Advisory ID: 1538
Released: Sun Aug 30 16:33:19 2026
Summary: Recommended update for update-bootloader
Type: recommended
Severity: moderate
References: 1271602
This update for update-bootloader fixes the following issues:
- update to version 1.28:
* fix test suite
* add test case
* adjust two tests
* updated test results
* fix command line parser (bsc#1271602)
* fix and reenable ksh tests: ksh uses alts now
* update ksh test results
-----------------------------------------------------------------
Advisory ID: 1562
Released: Mon Aug 31 07:56:37 2026
Summary: Security update for libgpg-error
Type: security
Severity: moderate
References: 1263078
This update for libgpg-error fixes the following issue:
- Out-of-bounds read in `_gpgrt_vfnameconcat` of `stringutils.c` when the `GPGRT_FCONCAT_SYSCONF` flag is used
(bsc#1263078).
-----------------------------------------------------------------
Advisory ID: 1573
Released: Mon Aug 31 22:36:28 2026
Summary: Recommended update for gcc16
Type: recommended
Severity: moderate
References: 1272616
This update for gcc16 fixes the following issues:
gcc16 is shipped as new package.
This update ships the GNU Compiler Collection GCC 16.2.
The compiler runtime libraries are provided for SUSE Linux Enterprise 16.0
versions and replace the same named GCC 14 ones.
The new compilers are provided in the PackageHub 16.0 only.
To use gcc16 compilers use:
- install 'gcc16' or 'gcc16-c++' or one of the other 'gcc16-COMPILER' frontend packages.
- override your Makefile to use CC=gcc16, CXX=g++16 and similar overrides for the other languages.
For a full changelog with all new GCC16 features, check out
https://gcc.gnu.org/gcc-16/changes.html
- Update to GCC 16.2 release (gcc-16.2.0+git9497)
* accumulated bugfixes from the gcc-16 release branch
- Disable multilibs for cross-x86_64-gcc
-----------------------------------------------------------------
Advisory ID: 1592
Released: Wed Sep 2 17:55:21 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: 1602
Released: Thu Sep 3 22:41:28 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1237515,1254924,1259418,1259650,1261400,1271444,CVE-2026-16742,CVE-2026-29111,CVE-2026-40226,CVE-2026-4105
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742: `systemd-homed`: local privilege escalation due to missing home record signature verification on
the authentication path (bsc#1271444).
Non security issue fixed:
- `systemd-resolved` fails to start due to write access to `tmpfs` denied (bsc#1237515).
-----------------------------------------------------------------
Advisory ID: 1610
Released: Fri Sep 4 15:48:44 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: 1661
Released: Fri Sep 11 13:45:57 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
-----------------------------------------------------------------
Advisory ID: 1688
Released: Wed Sep 16 16:28:22 2026
Summary: Security update for rpm
Type: security
Severity: important
References: 1218459,1253139,1259215,1268747,1269150,1269571,1269584,CVE-2026-44604,CVE-2026-44605
This update for rpm fixes the following issues:
Changes in rpm:
- split imaevmsign plugin into a multibuild flavor
Changes in rpm:
- Add Requires: (rpm-plugin-selinux if selinux-policy)
- harden ndb code [bsc#1269584] [CVE-2026-44605]
- split all plugins into subpackages
* this allows for an easy way to get rid of a plugin, it's also
what other distributions do
- make the imaevmsign plugin build in a multibuild flavor
- rpm2archive: use size 0 for hardlinked files as bnew versions of
gnu tar reject non-zero sizes [bsc#1269150]
- backport fix for add_sysuser macro [bsc#1269571]
- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
- switch from rpmpgp_legacy to libpgpr
* multiple bug fixes, support for v5 and v6 signatures
- turn on imaevm file signature support and move the imaevm code
that needs the libimaevm library into a plugin. Put this
plugin into a new 'rpm-imaevmsign' subpackage. [jsc#PED-7246]
- Fix 'unexpected EOF' when using rpmbuild to install ELF binaries
due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
- Remove /var/lib/rpm migration scripting, retain an error if old
location is found
- Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink
(boo#1253139)
- flush scriptlet notification messages in --runposttrans
* needed to fix leaking tmp files [bsc#1218459]
* added 'rpm_flushes_runposttrans' provides for libzypp
-----------------------------------------------------------------
Advisory ID: 1707
Released: Fri Sep 18 18:31:02 2026
Summary: Recommended update for gcc15, gcc16
Type: recommended
Severity: critical
References: 1277919
This update for gcc15, gcc16 fixes the following issues:
Changes in gcc15:
- Rebuild to rename library packages after the switch to gcc16
libraries.
Changes in gcc16:
- Fix build reproducability when PCH is used.
- Fix auto-detection of Zen6 [bsc#1277919]
- Remove support for s390 (32bit), make sure to configure s390x with
--disable-multilib to avoid configury error without explicit
disable of multilibs. Support for s390 is officially deprecated.
-----------------------------------------------------------------
Advisory ID: 1733
Released: Tue Sep 22 09:23:33 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,1270219,1275441,1278347,1278348,1278349,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614,CVE-2026-76642,CVE-2026-78408,CVE-2026-78410
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
-----------------------------------------------------------------
Advisory ID: 1738
Released: Tue Sep 22 16:23:31 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1236344,1240890,1240957,1249104,1255225,1255531,1256629,1256671,1258278,1260501,1260577,1262073,1262756,1263004,1263864,1263865,1264267,1264335,1264444,1264541,1264587,1264619,1264807,1264851,1265036,1265068,1265121,1265132,1265141,1265220,1266710,1266860,1266874,1266897,1266928,1267023,1267238,1267373,1267501,1267586,1267612,1267882,1267985,1268972,1268979,1269000,1269004,1269010,1269013,1269108,1269113,1269114,1269126,1269134,1269140,1269162,1269167,1269238,1269242,1269256,1269301,1269306,1269380,1269381,1269388,1269402,1269412,1269417,1269528,1269530,1269579,1269590,1269633,1269635,1269655,1269665,1269685,1269686,1269695,1269697,1269774,1269783,1269792,1269815,1269816,1269888,1269965,1269969,1269985,1269999,1270090,1270108,1270111,1270139,1270251,1270266,1270267,1271050,1271256,1271365,1271825,1272148,1272149,1272175,1272182,1272199,1272200,1272210,1272213,1272230,1272260,1272261,1272262,1272284,1272287,1272297,1272346,1272366,1272385,1272390,1272423,1272426,1272429,1
272484,1272486,1272497,1272501,1272502,1272513,1272516,1272568,1272569,1272584,1272641,1272643,1272673,1272756,1272786,1272788,1272791,1272798,1272799,1272804,1272855,1272865,1272868,1272869,1272877,1272891,1272893,1272894,1272904,1272905,1272918,1272963,1272969,1272971,1272983,1272985,1273008,1273019,1273027,1273030,1273032,1273033,1273036,1273037,1273038,1273060,1273105,1273107,1273119,1273134,1273231,1273249,1273251,1273260,1273271,1273273,1273274,1273276,1273277,1273280,1273281,1273283,1273284,1273285,1273286,1273288,1273289,1273291,1273294,1273302,1273303,1273305,1273309,1273310,1273311,1273312,1273314,1273316,1273317,1273318,1273319,1273323,1273325,1273327,1273331,1273334,1273335,1273336,1273337,1273338,1273339,1273340,1273341,1273346,1273420,1273422,1273426,1273443,1273460,1273461,1273463,1273465,1273468,1273469,1273471,1273479,1273480,1273482,1273484,1273486,1273488,1273490,1273495,1273501,1273503,1273504,1273506,1273507,1273509,1273511,1273520,1273523,1273524,1273525,127353
3,1273536,1273538,1273542,1273550,1273555,1273557,1273567,1273578,1273579,1273581,1273582,1273596,1273597,1273598,1273600,1273601,1273602,1273603,1273679,1273681,1273682,1273734,1273737,1273738,1273739,1273740,1273741,1273742,1273743,1273744,1273745,1273746,1273748,1273749,1273755,1273759,1273762,1273765,1273766,1273769,1273770,1273774,1273776,1273778,1273780,1273782,1273788,1273790,1273796,1273797,1273801,1273803,1273804,1273809,1273810,1273811,1273812,1273813,1273817,1273822,1273824,1273831,1273834,1273838,1273839,1273842,1273844,1273848,1273849,1273852,1273855,1273859,1273860,1273862,1273864,1273866,1273867,1273868,1273869,1273870,1273872,1273876,1273877,1273880,1273882,1273890,1273891,1273892,1273895,1273896,1273898,1273899,1273903,1273904,1273905,1273930,1273933,1273934,1273935,1273936,1273939,1273940,1273941,1273942,1273944,1273945,1273946,1273947,1273949,1273953,1273954,1273956,1273957,1273958,1273959,1273963,1273966,1273967,1273968,1273972,1273974,1273975,1273977,1273988,127
3990,1273991,1273995,1273997,1273999,1274001,1274003,1274006,1274008,1274009,1274010,1274011,1274012,1274014,1274017,1274019,1274020,1274026,1274028,1274030,1274031,1274035,1274036,1274040,1274041,1274052,1274055,1274057,1274058,1274060,1274063,1274065,1274067,1274071,1274075,1274076,1274077,1274078,1274208,1274226,1274239,1274243,1274252,1274253,1274258,1274264,1274265,1274267,1274274,1274277,1274278,1274281,1274283,1274286,1274290,1274292,1274294,1274295,1274296,1274314,1274321,1274491,1274492,1274494,1274497,1274539,1274541,1274543,1274545,1274547,1274550,1274556,1274573,1274578,1274580,1274581,1274622,1274624,1274628,1274632,1274636,1274637,1274639,1274640,1274642,1274644,1274645,1274646,1274650,1274651,1274652,1274656,1274657,1274659,1274662,1274665,1274667,1274669,1274670,1274671,1274675,1274677,1274678,1274679,1274681,1274682,1274690,1274694,1274696,1274698,1274699,1274700,1274702,1274703,1274705,1274706,1274707,1274709,1274710,1274713,1274716,1274721,1274725,1274727,1274730,
1274737,1274738,1274749,1274750,1274751,1274752,1274753,1274754,1274755,1274756,1274764,1274768,1274770,1274771,1274773,1274782,1274783,1274787,1274800,1274801,1274802,1274803,1274804,1274805,1274807,1274808,1274811,1274813,1274814,1274831,1274834,1274835,1274838,1274847,1274849,1274853,1274868,1274869,1274872,1274873,1274874,1274876,1274877,1274879,1274881,1274883,1274886,1274887,1274888,1274891,1274892,1274893,1274894,1274895,1274896,1274897,1274898,1274899,1274900,1274901,1274902,1274904,1274905,1274906,1274907,1274908,1274913,1274914,1274921,1274924,1274925,1274927,1274929,1274930,1274933,1274934,1274935,1274938,1274939,1274940,1274941,1274945,1274947,1274951,1274952,1274953,1274955,1274957,1274958,1274965,1274968,1274978,1274981,1275040,1275045,1275069,1275071,1275072,1275073,1275076,1275080,1275081,1275083,1275088,1275091,1275092,1275094,1275125,1275126,1275129,1275131,1275132,1275139,1275141,1275146,1275148,1275149,1275150,1275152,1275154,1275155,1275156,1275157,1275158,12751
60,1275161,1275163,1275164,1275169,1275173,1275176,1275185,1275190,1275192,1275229,1275236,1275237,1275238,1275239,1275294,1275300,1275301,1275303,1275304,1275305,1275306,1275307,1275470,1275474,1275479,1275481,1275483,1275486,1275487,1275496,1275506,1275509,1275511,1275514,1275517,1275519,1275528,1275535,1275540,1275553,1275555,1275557,1275561,1275566,1275569,1275572,1275574,1275578,1275582,1275583,1275584,1275587,1275588,1275591,1275595,1275596,1275633,1275636,1275650,1275655,1275656,1275659,1275665,1275669,1275672,1275679,1275685,1275687,1275688,1275690,1275695,1275696,1275704,1275737,1275782,1275784,1275787,1275788,1275789,1275790,1275798,1275799,1275801,1275802,1275804,1275805,1275812,1275817,1275818,1275819,1275820,1275821,1275822,1275823,1275827,1275864,1275866,1275867,1275869,1275870,1275871,1275872,1275886,1275905,1275923,1275925,1275928,1275950,1275954,1275956,1275970,1275973,1275975,1275976,1275985,1276006,1276029,1276257,1276258,1276263,1276265,1276267,1276270,1276273,12
76277,1276333,1276335,1276339,1276341,1276346,1276354,1276355,1276381,1276395,1276446,1276452,1276468,1276471,1276473,1276500,1276507,1276512,1276528,1276542,1276546,1276547,1276551,1276552,1276553,1276561,1276562,1276566,1276569,1276572,1276577,1276586,1276665,1276766,1276767,1276771,1276785,1276793,1276801,1276803,1276814,1276818,1276821,1276831,1276840,1276864,1276865,1276866,1276870,1276876,1276880,1276905,1276913,1276922,1276931,1276937,1276941,1276955,1276957,1276961,1277022,1277023,1277033,1277034,1277037,1277047,1277054,1277057,1277059,1277062,1277066,1277069,1277070,1277077,1277078,1277092,1277095,1277108,1277114,1277115,1277118,1277120,1277155,1277159,1277160,1277202,1277204,1277227,1277229,1277230,1277231,1277233,1277249,1277254,1277265,1277268,1277275,1277285,1277308,1277311,1277315,1277321,1277328,1277335,1277349,1277350,1277391,1277407,1277408,1277485,1277505,1277513,1277551,1277553,1277561,1277574,1277636,1277641,1277649,1277655,1277656,1277660,1277668,1277680,1277688
,1277726,1277728,1277738,1277748,1277761,1277764,1277773,1277775,1277776,1277782,1277783,1277813,1277818,1277822,1277845,1277862,1277874,1277876,1277898,1277901,1277908,1277918,1278039,1278070,1278088,1278094,1278098,1278113,1278155,1278180,1278233,1278236,1278240,1278253,1278293,1278324,1278331,1278334,1278395,1278416,1278703,1278716,1278733,1279487,1279537,1279580,1279813,1279842,1279847,1279887,1280139,CVE-2025-68214,CVE-2025-68358,CVE-2025-68780,CVE-2025-71075,CVE-2026-23113,CVE-2026-23306,CVE-2026-23348,CVE-2026-31418,CVE-2026-31530,CVE-2026-31531,CVE-2026-43116,CVE-2026-43125,CVE-2026-43163,CVE-2026-43239,CVE-2026-43271,CVE-2026-43299,CVE-2026-43331,CVE-2026-43355,CVE-2026-43363,CVE-2026-43416,CVE-2026-43439,CVE-2026-43448,CVE-2026-45860,CVE-2026-45897,CVE-2026-45968,CVE-2026-46007,CVE-2026-46070,CVE-2026-46091,CVE-2026-46107,CVE-2026-46115,CVE-2026-46133,CVE-2026-46135,CVE-2026-46195,CVE-2026-46304,CVE-2026-52912,CVE-2026-52920,CVE-2026-52928,CVE-2026-52929,CVE-2026-52935,CVE
-2026-52939,CVE-2026-52946,CVE-2026-52977,CVE-2026-52990,CVE-2026-52991,CVE-2026-52994,CVE-2026-53001,CVE-2026-53031,CVE-2026-53033,CVE-2026-53034,CVE-2026-53048,CVE-2026-53059,CVE-2026-53061,CVE-2026-53076,CVE-2026-53077,CVE-2026-53089,CVE-2026-53091,CVE-2026-53092,CVE-2026-53094,CVE-2026-53096,CVE-2026-53109,CVE-2026-53110,CVE-2026-53111,CVE-2026-53114,CVE-2026-53126,CVE-2026-53129,CVE-2026-53142,CVE-2026-53154,CVE-2026-53163,CVE-2026-53180,CVE-2026-53207,CVE-2026-53219,CVE-2026-53220,CVE-2026-53223,CVE-2026-53228,CVE-2026-53238,CVE-2026-53264,CVE-2026-53269,CVE-2026-53284,CVE-2026-53291,CVE-2026-53309,CVE-2026-53330,CVE-2026-53336,CVE-2026-53337,CVE-2026-53341,CVE-2026-53353,CVE-2026-53365,CVE-2026-53388,CVE-2026-63801,CVE-2026-63803,CVE-2026-63804,CVE-2026-63808,CVE-2026-63810,CVE-2026-63823,CVE-2026-63828,CVE-2026-63860,CVE-2026-63865,CVE-2026-63868,CVE-2026-63879,CVE-2026-63887,CVE-2026-63888,CVE-2026-63889,CVE-2026-63890,CVE-2026-63891,CVE-2026-63898,CVE-2026-63901,CVE-2026-6
3906,CVE-2026-63917,CVE-2026-63918,CVE-2026-63920,CVE-2026-63921,CVE-2026-63922,CVE-2026-63924,CVE-2026-63925,CVE-2026-63926,CVE-2026-63928,CVE-2026-63941,CVE-2026-63969,CVE-2026-63970,CVE-2026-63984,CVE-2026-63985,CVE-2026-63986,CVE-2026-63987,CVE-2026-63990,CVE-2026-63992,CVE-2026-63993,CVE-2026-63995,CVE-2026-63996,CVE-2026-63997,CVE-2026-63998,CVE-2026-63999,CVE-2026-64000,CVE-2026-64001,CVE-2026-64002,CVE-2026-64003,CVE-2026-64004,CVE-2026-64005,CVE-2026-64006,CVE-2026-64007,CVE-2026-64010,CVE-2026-64011,CVE-2026-64014,CVE-2026-64015,CVE-2026-64017,CVE-2026-64024,CVE-2026-64029,CVE-2026-64033,CVE-2026-64039,CVE-2026-64047,CVE-2026-64048,CVE-2026-64051,CVE-2026-64052,CVE-2026-64053,CVE-2026-64054,CVE-2026-64055,CVE-2026-64056,CVE-2026-64071,CVE-2026-64073,CVE-2026-64083,CVE-2026-64084,CVE-2026-64085,CVE-2026-64086,CVE-2026-64087,CVE-2026-64088,CVE-2026-64089,CVE-2026-64093,CVE-2026-64097,CVE-2026-64098,CVE-2026-64099,CVE-2026-64102,CVE-2026-64103,CVE-2026-64104,CVE-2026-64105,CV
E-2026-64109,CVE-2026-64111,CVE-2026-64112,CVE-2026-64113,CVE-2026-64114,CVE-2026-64115,CVE-2026-64118,CVE-2026-64119,CVE-2026-64121,CVE-2026-64125,CVE-2026-64126,CVE-2026-64127,CVE-2026-64128,CVE-2026-64131,CVE-2026-64133,CVE-2026-64134,CVE-2026-64135,CVE-2026-64137,CVE-2026-64144,CVE-2026-64146,CVE-2026-64147,CVE-2026-64148,CVE-2026-64155,CVE-2026-64162,CVE-2026-64164,CVE-2026-64166,CVE-2026-64168,CVE-2026-64169,CVE-2026-64170,CVE-2026-64177,CVE-2026-64178,CVE-2026-64179,CVE-2026-64180,CVE-2026-64184,CVE-2026-64185,CVE-2026-64190,CVE-2026-64192,CVE-2026-64210,CVE-2026-64214,CVE-2026-64217,CVE-2026-64219,CVE-2026-64222,CVE-2026-64224,CVE-2026-64225,CVE-2026-64232,CVE-2026-64237,CVE-2026-64239,CVE-2026-64240,CVE-2026-64243,CVE-2026-64244,CVE-2026-64245,CVE-2026-64246,CVE-2026-64247,CVE-2026-64249,CVE-2026-64253,CVE-2026-64256,CVE-2026-64265,CVE-2026-64266,CVE-2026-64268,CVE-2026-64269,CVE-2026-64270,CVE-2026-64271,CVE-2026-64272,CVE-2026-64273,CVE-2026-64274,CVE-2026-64275,CVE-2026-
64276,CVE-2026-64277,CVE-2026-64278,CVE-2026-64279,CVE-2026-64283,CVE-2026-64286,CVE-2026-64287,CVE-2026-64294,CVE-2026-64296,CVE-2026-64298,CVE-2026-64300,CVE-2026-64301,CVE-2026-64303,CVE-2026-64304,CVE-2026-64305,CVE-2026-64306,CVE-2026-64307,CVE-2026-64308,CVE-2026-64309,CVE-2026-64310,CVE-2026-64312,CVE-2026-64313,CVE-2026-64315,CVE-2026-64316,CVE-2026-64317,CVE-2026-64319,CVE-2026-64320,CVE-2026-64321,CVE-2026-64322,CVE-2026-64323,CVE-2026-64326,CVE-2026-64327,CVE-2026-64328,CVE-2026-64329,CVE-2026-64331,CVE-2026-64332,CVE-2026-64333,CVE-2026-64334,CVE-2026-64335,CVE-2026-64337,CVE-2026-64338,CVE-2026-64340,CVE-2026-64341,CVE-2026-64342,CVE-2026-64343,CVE-2026-64344,CVE-2026-64346,CVE-2026-64348,CVE-2026-64350,CVE-2026-64351,CVE-2026-64354,CVE-2026-64355,CVE-2026-64358,CVE-2026-64362,CVE-2026-64364,CVE-2026-64365,CVE-2026-64367,CVE-2026-64368,CVE-2026-64373,CVE-2026-64375,CVE-2026-64376,CVE-2026-64378,CVE-2026-64380,CVE-2026-64381,CVE-2026-64382,CVE-2026-64383,CVE-2026-64384,C
VE-2026-64385,CVE-2026-64386,CVE-2026-64387,CVE-2026-64401,CVE-2026-64403,CVE-2026-64404,CVE-2026-64406,CVE-2026-64407,CVE-2026-64408,CVE-2026-64409,CVE-2026-64411,CVE-2026-64412,CVE-2026-64415,CVE-2026-64416,CVE-2026-64420,CVE-2026-64421,CVE-2026-64423,CVE-2026-64427,CVE-2026-64429,CVE-2026-64433,CVE-2026-64434,CVE-2026-64436,CVE-2026-64440,CVE-2026-64442,CVE-2026-64443,CVE-2026-64444,CVE-2026-64445,CVE-2026-64446,CVE-2026-64450,CVE-2026-64452,CVE-2026-64454,CVE-2026-64455,CVE-2026-64456,CVE-2026-64458,CVE-2026-64463,CVE-2026-64470,CVE-2026-64471,CVE-2026-64472,CVE-2026-64477,CVE-2026-64478,CVE-2026-64479,CVE-2026-64480,CVE-2026-64481,CVE-2026-64482,CVE-2026-64483,CVE-2026-64484,CVE-2026-64486,CVE-2026-64487,CVE-2026-64489,CVE-2026-64490,CVE-2026-64494,CVE-2026-64495,CVE-2026-64496,CVE-2026-64497,CVE-2026-64499,CVE-2026-64500,CVE-2026-64503,CVE-2026-64504,CVE-2026-64505,CVE-2026-64507,CVE-2026-64511,CVE-2026-64512,CVE-2026-64513,CVE-2026-64515,CVE-2026-64517,CVE-2026-64518,CVE-2026
-64519,CVE-2026-64524,CVE-2026-64525,CVE-2026-64526,CVE-2026-64527,CVE-2026-64534,CVE-2026-64535,CVE-2026-64536,CVE-2026-64537,CVE-2026-64538,CVE-2026-64539,CVE-2026-64540,CVE-2026-64541,CVE-2026-64542,CVE-2026-64543,CVE-2026-64544,CVE-2026-64545,CVE-2026-64546,CVE-2026-64547,CVE-2026-64548,CVE-2026-64549,CVE-2026-64551,CVE-2026-64552,CVE-2026-64553,CVE-2026-64554,CVE-2026-64555,CVE-2026-64556,CVE-2026-64558,CVE-2026-64559,CVE-2026-64561,CVE-2026-64562,CVE-2026-64563,CVE-2026-64565,CVE-2026-64567,CVE-2026-64568,CVE-2026-64569,CVE-2026-64570,CVE-2026-64571,CVE-2026-64572,CVE-2026-64573,CVE-2026-64574,CVE-2026-64576,CVE-2026-64577,CVE-2026-64579,CVE-2026-64581,CVE-2026-64582,CVE-2026-64583,CVE-2026-64584,CVE-2026-64585,CVE-2026-64586,CVE-2026-64589,CVE-2026-64593,CVE-2026-64599,CVE-2026-64602,CVE-2026-64603,CVE-2026-64604,CVE-2026-68081,CVE-2026-68082,CVE-2026-68085,CVE-2026-68086,CVE-2026-68088,CVE-2026-68091,CVE-2026-68093,CVE-2026-68096,CVE-2026-68102,CVE-2026-68104,CVE-2026-68105,
CVE-2026-68106,CVE-2026-68107,CVE-2026-68108,CVE-2026-68110,CVE-2026-68111,CVE-2026-68112,CVE-2026-68113,CVE-2026-68115,CVE-2026-68116,CVE-2026-68117,CVE-2026-68120,CVE-2026-68121,CVE-2026-68123,CVE-2026-68124,CVE-2026-68125,CVE-2026-68126,CVE-2026-68127,CVE-2026-68128,CVE-2026-68129,CVE-2026-68132,CVE-2026-68133,CVE-2026-68135,CVE-2026-68136,CVE-2026-68137,CVE-2026-68138,CVE-2026-68139,CVE-2026-68141,CVE-2026-68142,CVE-2026-68143,CVE-2026-68144,CVE-2026-68145,CVE-2026-68148,CVE-2026-68149,CVE-2026-68152,CVE-2026-68153,CVE-2026-68154,CVE-2026-68155,CVE-2026-68156,CVE-2026-68157,CVE-2026-68158,CVE-2026-68159,CVE-2026-68161,CVE-2026-68164,CVE-2026-68165,CVE-2026-68166,CVE-2026-68169,CVE-2026-68178,CVE-2026-68179,CVE-2026-68180,CVE-2026-68181,CVE-2026-68182,CVE-2026-68183,CVE-2026-68184,CVE-2026-68188,CVE-2026-68189,CVE-2026-68192,CVE-2026-68193,CVE-2026-68194,CVE-2026-68195,CVE-2026-68196,CVE-2026-68197,CVE-2026-68198,CVE-2026-68199,CVE-2026-68200,CVE-2026-68201,CVE-2026-68202,CVE-202
6-68203,CVE-2026-68204,CVE-2026-68205,CVE-2026-68206,CVE-2026-68207,CVE-2026-68209,CVE-2026-68210,CVE-2026-68212,CVE-2026-68213,CVE-2026-68214,CVE-2026-68215,CVE-2026-68216,CVE-2026-68217,CVE-2026-68218,CVE-2026-68219,CVE-2026-68220,CVE-2026-68221,CVE-2026-68222,CVE-2026-68223,CVE-2026-68225,CVE-2026-68226,CVE-2026-68227,CVE-2026-68228,CVE-2026-68229,CVE-2026-68231,CVE-2026-68234,CVE-2026-68235,CVE-2026-68236,CVE-2026-68238,CVE-2026-68243,CVE-2026-68244,CVE-2026-68245,CVE-2026-68246,CVE-2026-68247,CVE-2026-68248,CVE-2026-68249,CVE-2026-68250,CVE-2026-68251,CVE-2026-68252,CVE-2026-68253,CVE-2026-68254,CVE-2026-68255,CVE-2026-68256,CVE-2026-68257,CVE-2026-68258,CVE-2026-68259,CVE-2026-68260,CVE-2026-68261,CVE-2026-68262,CVE-2026-68263,CVE-2026-68267,CVE-2026-68269,CVE-2026-68271,CVE-2026-68272,CVE-2026-68273,CVE-2026-68277,CVE-2026-68278,CVE-2026-68279,CVE-2026-68280,CVE-2026-68281,CVE-2026-68284,CVE-2026-68286,CVE-2026-68288,CVE-2026-68289,CVE-2026-68293,CVE-2026-68294,CVE-2026-68296
,CVE-2026-68297,CVE-2026-68299,CVE-2026-68300,CVE-2026-68302,CVE-2026-68303,CVE-2026-68304,CVE-2026-68306,CVE-2026-68307,CVE-2026-68308,CVE-2026-68309,CVE-2026-68310,CVE-2026-68311,CVE-2026-68313,CVE-2026-68315,CVE-2026-68319,CVE-2026-68320,CVE-2026-68321,CVE-2026-68322,CVE-2026-68325,CVE-2026-68326,CVE-2026-68327,CVE-2026-68328,CVE-2026-68329,CVE-2026-68331,CVE-2026-68333,CVE-2026-68335,CVE-2026-68336,CVE-2026-68338,CVE-2026-68339,CVE-2026-68340,CVE-2026-68344,CVE-2026-68346,CVE-2026-68348,CVE-2026-68349,CVE-2026-68350,CVE-2026-68351,CVE-2026-68352,CVE-2026-68353,CVE-2026-68354,CVE-2026-68355,CVE-2026-68357,CVE-2026-68358,CVE-2026-68359,CVE-2026-68360,CVE-2026-68361,CVE-2026-68362,CVE-2026-68363,CVE-2026-68365,CVE-2026-68366,CVE-2026-68368,CVE-2026-68369,CVE-2026-68370,CVE-2026-68371,CVE-2026-68372,CVE-2026-68373,CVE-2026-68374,CVE-2026-68375,CVE-2026-68377,CVE-2026-68386,CVE-2026-68389,CVE-2026-68391,CVE-2026-68392,CVE-2026-68393,CVE-2026-68394,CVE-2026-68395,CVE-2026-68397,CVE-20
26-68398,CVE-2026-68399,CVE-2026-68402,CVE-2026-68403,CVE-2026-68405,CVE-2026-68406,CVE-2026-68407,CVE-2026-68408,CVE-2026-68410,CVE-2026-68413,CVE-2026-68414,CVE-2026-68416,CVE-2026-68417,CVE-2026-68418,CVE-2026-68419,CVE-2026-68422,CVE-2026-68425,CVE-2026-68426,CVE-2026-68427,CVE-2026-68428,CVE-2026-68429,CVE-2026-68430,CVE-2026-68432,CVE-2026-68433,CVE-2026-68434,CVE-2026-68437,CVE-2026-68439,CVE-2026-68442,CVE-2026-68443,CVE-2026-68444,CVE-2026-68445,CVE-2026-68446,CVE-2026-68448,CVE-2026-68450,CVE-2026-68470,CVE-2026-68480,CVE-2026-72017,CVE-2026-72019,CVE-2026-72020,CVE-2026-72022,CVE-2026-72023,CVE-2026-72032,CVE-2026-72034,CVE-2026-72035,CVE-2026-72036,CVE-2026-72045,CVE-2026-72046,CVE-2026-72051,CVE-2026-72052,CVE-2026-72053,CVE-2026-72054,CVE-2026-72055,CVE-2026-72061,CVE-2026-72069,CVE-2026-72072,CVE-2026-72083,CVE-2026-72084,CVE-2026-72100,CVE-2026-72101,CVE-2026-72103,CVE-2026-72106,CVE-2026-72107,CVE-2026-72108,CVE-2026-72132,CVE-2026-72136,CVE-2026-72137,CVE-2026-7216
1,CVE-2026-72163,CVE-2026-72164,CVE-2026-72176,CVE-2026-72177,CVE-2026-72217,CVE-2026-72221,CVE-2026-72222,CVE-2026-72234,CVE-2026-72242,CVE-2026-72243,CVE-2026-72251,CVE-2026-72254,CVE-2026-72280,CVE-2026-72282,CVE-2026-72288,CVE-2026-72289,CVE-2026-72296,CVE-2026-72297,CVE-2026-72306,CVE-2026-72307,CVE-2026-72308,CVE-2026-72317,CVE-2026-72323,CVE-2026-72325,CVE-2026-72330,CVE-2026-72337,CVE-2026-72339,CVE-2026-72341,CVE-2026-72342,CVE-2026-72343,CVE-2026-72345,CVE-2026-72347,CVE-2026-72350,CVE-2026-72366,CVE-2026-72379,CVE-2026-72389,CVE-2026-72398,CVE-2026-72399,CVE-2026-72414,CVE-2026-72421,CVE-2026-72425,CVE-2026-72430,CVE-2026-72437,CVE-2026-72438,CVE-2026-72439,CVE-2026-72440,CVE-2026-72448,CVE-2026-72450,CVE-2026-72459,CVE-2026-72460,CVE-2026-72464,CVE-2026-72466,CVE-2026-72467,CVE-2026-72468,CVE-2026-72469,CVE-2026-72473,CVE-2026-72485,CVE-2026-72487,CVE-2026-72488,CVE-2026-72494,CVE-2026-72495,CVE-2026-72497,CVE-2026-72499,CVE-2026-72500,CVE-2026-72501,CVE-2026-72502,CVE-2
026-74255,CVE-2026-74261,CVE-2026-74269,CVE-2026-74270,CVE-2026-74282,CVE-2026-74284,CVE-2026-74286,CVE-2026-74296,CVE-2026-74297,CVE-2026-74307,CVE-2026-74308,CVE-2026-74313,CVE-2026-74316,CVE-2026-74317,CVE-2026-74318,CVE-2026-74321,CVE-2026-74334,CVE-2026-74345,CVE-2026-74346,CVE-2026-74349,CVE-2026-74363,CVE-2026-74375,CVE-2026-74377,CVE-2026-74378,CVE-2026-74382,CVE-2026-74388,CVE-2026-74390,CVE-2026-74394,CVE-2026-74395,CVE-2026-74397,CVE-2026-74406,CVE-2026-74464,CVE-2026-74474,CVE-2026-74475,CVE-2026-74476,CVE-2026-74479,CVE-2026-74481,CVE-2026-74482,CVE-2026-74495,CVE-2026-74496,CVE-2026-74510,CVE-2026-74512,CVE-2026-74513,CVE-2026-74517,CVE-2026-74518,CVE-2026-74523,CVE-2026-74527,CVE-2026-74533,CVE-2026-74534,CVE-2026-74535,CVE-2026-74536,CVE-2026-74537,CVE-2026-74545,CVE-2026-74548,CVE-2026-74550,CVE-2026-74555,CVE-2026-74556,CVE-2026-74557,CVE-2026-74563,CVE-2026-74566,CVE-2026-74567,CVE-2026-74571,CVE-2026-74577,CVE-2026-74581,CVE-2026-74582,CVE-2026-74584,CVE-2026-745
98,CVE-2026-74610,CVE-2026-74612,CVE-2026-74615,CVE-2026-74616,CVE-2026-74622,CVE-2026-74644,CVE-2026-74665,CVE-2026-74669,CVE-2026-74695,CVE-2026-74705,CVE-2026-74712,CVE-2026-74717,CVE-2026-74719,CVE-2026-74722,CVE-2026-74723,CVE-2026-74730,CVE-2026-74737,CVE-2026-74743,CVE-2026-74744,CVE-2026-80529,CVE-2026-80530,CVE-2026-80531,CVE-2026-80533,CVE-2026-80534,CVE-2026-80535,CVE-2026-80557,CVE-2026-80558,CVE-2026-80561,CVE-2026-80586,CVE-2026-80589,CVE-2026-80590,CVE-2026-80603,CVE-2026-80609,CVE-2026-80629,CVE-2026-80646,CVE-2026-80647,CVE-2026-80667,CVE-2026-80681,CVE-2026-80693,CVE-2026-80714,CVE-2026-80721,CVE-2026-80727,CVE-2026-80731,CVE-2026-80737,CVE-2026-80739,CVE-2026-80805,CVE-2026-80813,CVE-2026-80838
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
- CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
- CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
- CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).
- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).
- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).
- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).
- CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).
- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).
- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).
- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).
- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).
- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).
- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).
- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).
- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).
- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).
- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).
- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).
- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).
- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).
- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).
- CVE-2026-53341: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (bsc#1270139).
- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).
- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).
- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).
- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).
- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).
- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).
- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).
- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).
- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).
- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).
- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).
- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).
- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).
- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).
- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).
- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).
- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).
- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).
- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).
- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).
- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).
- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).
- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).
- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
- CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).
- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).
- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).
- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).
- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).
- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).
- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).
- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).
- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).
- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).
- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).
- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).
- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).
- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).
- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).
- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).
- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).
- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).
- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
- CVE-2026-64109: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (bsc#1273748).
- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).
- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).
- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).
- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).
- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).
- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).
- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).
- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).
- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).
- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).
- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).
- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).
- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).
- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).
- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).
- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).
- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).
- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).
- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).
- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
(bsc#1272799).
- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
- CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788).
- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).
- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).
- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).
- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).
- CVE-2026-64244: drivers/base/memory: set mem->altmap after successful device registration (bsc#1273812).
- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).
- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).
- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).
- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).
- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).
- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).
- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).
- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).
- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).
- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).
- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).
- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).
- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).
- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).
- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).
- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).
- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).
- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).
- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks (bsc#1273283).
- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).
- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).
- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).
- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).
- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).
- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).
- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).
- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).
- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).
- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).
- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).
- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).
- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).
- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).
- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).
- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).
- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).
- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).
- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).
- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).
- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).
- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).
- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).
- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).
- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).
- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).
- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).
- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).
- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).
- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).
- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).
- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
- CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).
- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).
- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).
- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).
- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).
- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).
- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).
- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).
- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).
- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).
- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).
- CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881).
- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).
- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).
- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).
- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).
- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).
- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).
- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).
- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).
- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).
- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).
- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).
- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).
- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).
- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).
- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).
- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).
- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).
- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).
- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).
- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).
- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
- CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305).
- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).
- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).
- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).
- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).
- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).
- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).
- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).
- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).
- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).
- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).
- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).
- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).
- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).
- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).
- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).
- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).
- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).
- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).
- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).
- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).
- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).
- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).
- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).
- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).
- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).
- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).
- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).
- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).
- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).
- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).
- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).
- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).
- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).
- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).
- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).
- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).
- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).
- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).
- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).
- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).
- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).
- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).
- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).
- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).
- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).
- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).
- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).
- CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).
- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).
- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).
- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).
- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).
- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).
- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).
- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).
- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).
- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).
- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).
- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).
- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).
- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).
- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).
- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).
- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).
- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).
- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).
- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).
- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).
- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).
- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).
- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).
- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).
- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).
- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).
- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).
- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
- CVE-2026-72234: batman-adv: access unicast_ttvn skb->data only after skb realloc (bsc#1275672).
- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).
- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).
- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).
- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).
- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).
- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).
- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).
- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).
- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).
- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).
- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).
- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).
- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).
- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).
- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
- CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660).
- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).
- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).
- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).
- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).
- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).
- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).
- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).
- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).
- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).
- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).
- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).
- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).
- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).
- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).
- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).
- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).
- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).
- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).
- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).
- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).
- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).
- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).
- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).
- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).
- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).
- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).
- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).
- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).
- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).
- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).
- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).
- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).
- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).
- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).
- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).
- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).
- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).
- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).
- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).
- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).
- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).
- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).
- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).
- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).
- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).
- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).
- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).
- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).
- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).
- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).
- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).
- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095).
- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).
- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).
- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).
- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).
- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).
- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).
- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).
- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).
- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).
- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).
- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).
- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).
- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).
- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).
- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).
- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).
- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).
- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).
- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).
- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).
- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).
- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).
- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).
- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).
- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).
- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).
- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).
- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).
- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).
- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).
- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).
- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).
- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).
- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).
- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).
- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).
- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).
- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).
- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).
- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).
- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).
- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
(bsc#1276572).
- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).
- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).
- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).
- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).
- CVE-2026-80531: xfs: avoid UAF on sc->tempip in xrep_tempfile_create (bsc#1277680).
- CVE-2026-80533: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair (bsc#1277636).
- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).
- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).
- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).
- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).
- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).
- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).
- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).
- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).
- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).
- CVE-2026-80609: qede: fix out-of-bounds check for cqe->len_list (bsc#1278334).
- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).
- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).
- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).
- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).
- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).
- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).
- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).
- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).
- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).
- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).
- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).
- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).
- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).
The following non security issues were fixed:
- accel/ivpu: Limit firmware log name prints to field size (git-fixes).
- accel/ivpu: Validate firmware log buffer metadata (git-fixes).
- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).
- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).
- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).
- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).
- ACPI: battery: Adjust charging status validation check (git-fixes).
- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).
- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).
- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).
- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).
- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).
- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).
- ACPI: video: Release PCI device reference after lookup (git-fixes).
- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).
- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).
- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).
- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).
- ALSA: caiaq: Fix potential double-free at error path (git-fixes).
- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).
- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).
- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).
- ALSA: dummy: Check card index validity at probe (stable-fixes).
- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).
- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).
- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).
- ALSA: hda: Fix connection list comparison in proc output (git-fixes).
- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).
- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).
- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).
- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).
- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).
- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).
- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).
- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).
- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).
- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).
- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).
- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).
- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).
- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).
- apparmor: advertise the tcp fast open fix is applied (git-fixes).
- ASoC: ab8500: Correct digital interface format setup (git-fixes).
- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).
- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).
- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).
- ASoC: adau1761: sort the register default table (git-fixes).
- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).
- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).
- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).
- ASoC: apple: mca: increase SERDES reset delay (git-fixes).
- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).
- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).
- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l41: sort the register default table (git-fixes).
- ASoC: cs35l45: sort the register default table (git-fixes).
- ASoC: cs4265: sort the register default table (git-fixes).
- ASoC: cx2072x: sort the register default table (git-fixes).
- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).
- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).
- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).
- ASoC: fsl_easrc: sort the register default table (git-fixes).
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).
- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).
- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).
- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).
- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).
- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).
- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).
- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).
- ASoC: max9860: sort the register default table (git-fixes).
- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).
- ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses (git-fixes).
- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).
- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).
- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).
- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).
- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).
- ASoC: ml26124: sort the register default table (git-fixes).
- ASoC: mt6351: Publish the OF module alias (git-fixes).
- ASoC: pcm512x: sort the register default table (git-fixes).
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).
- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).
- ASoC: rt274: sort the register default table (git-fixes).
- ASoC: rt286: sort the register default table (git-fixes).
- ASoC: rt298: sort the register default table (git-fixes).
- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).
- ASoC: rt700: drop duplicate reg_default entry (git-fixes).
- ASoC: rt700: sort the register default table (git-fixes).
- ASoC: rt711-sdca: sort the register default tables (git-fixes).
- ASoC: rt711: sort the register default table (git-fixes).
- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).
- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).
- ASoC: rt715-sdca: sort the register default tables (git-fixes).
- ASoC: rt715: sort the register default table (git-fixes).
- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt1316-sdw: sort the register default table (git-fixes).
- ASoC: rt1318-sdw: sort the register default table (git-fixes).
- ASoC: rt1318: sort the register default table (git-fixes).
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).
- ASoC: sgtl5000: sort the register default table (git-fixes).
- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).
- ASoC: SOF: validate topology volume range before allocation (git-fixes).
- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).
- ASoC: sti-sas: sort the register default table (git-fixes).
- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).
- ASoC: tas2552: sort the register default table (git-fixes).
- ASoC: tas2764: sort the register default table (git-fixes).
- ASoC: tas2780: sort the register default table (git-fixes).
- ASoC: tegra210_i2s: sort the register default table (git-fixes).
- ASoC: tegra210_mixer: sort the register default table (git-fixes).
- ASoC: tegra: Fix the MIXER enable default value (git-fixes).
- ASoC: tegra: Sort MBDRC register defaults (git-fixes).
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).
- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).
- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).
- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).
- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).
- batman-adv: fix stale receive device on merged fragments (git-fixes).
- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).
- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).
- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).
- blk-mq: reinsert cached request to the list (bsc#1273770).
- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).
- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).
- Bluetooth: btintel: validate version TLV value lengths (git-fixes).
- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).
- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).
- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).
- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).
- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).
- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).
- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).
- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).
- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).
- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).
- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).
- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).
- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).
- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).
- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).
- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).
- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).
- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).
- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).
- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).
- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).
- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).
- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).
- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).
- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).
- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).
- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).
- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).
- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).
- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).
- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).
- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).
- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).
- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).
- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).
- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).
- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).
- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).
- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).
- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).
- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).
- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).
- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).
- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).
- bnxt_en: Set bp->max_tpa according to what the FW supports (jsc#PED-16798).
- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).
- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).
- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).
- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).
- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).
- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).
- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).
- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).
- char: xilinx_hwicap: unregister class on init errors (git-fixes).
- cleanup: add a scoped version of CLASS() (stable-fixes).
- cleanup: fix scoped_class() (git-fixes).
- compiler_types: Introduce __flex_counter() and family (bsc#1280139).
- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).
- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).
- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).
- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).
- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).
- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).
- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).
- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).
- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).
- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).
- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).
- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).
- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).
- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).
- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).
- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).
- crypto: doc - Remove extra parenthesis (git-fixes).
- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).
- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).
- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).
- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).
- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).
- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).
- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).
- crypto: qat - clear AES key schedule from stack (git-fixes).
- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).
- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).
- crypto: qcom-rng - Allow zero as a random number (git-fixes).
- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).
- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).
- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).
- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (git-fixes).
- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).
- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).
- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).
- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).
- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).
- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).
- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).
- dmaengine: dw-edma: Serialize abort state updates (git-fixes).
- dmaengine: dw-edma: Serialize channel state checks (git-fixes).
- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).
- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).
- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).
- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).
- driver core: soc: Unregister bus on early device registration failure (git-fixes).
- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).
- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).
- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).
- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).
- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).
- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).
- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).
- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).
- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).
- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).
- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).
- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).
- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).
- drm/amd/pm: Use same metric table for APU (stable-fixes).
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).
- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).
- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).
- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).
- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).
- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).
- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).
- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).
- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).
- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).
- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).
- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).
- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).
- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).
- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (stable-fixes).
- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).
- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).
- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).
- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).
- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).
- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).
- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).
- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).
- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).
- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).
- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).
- drm/amdgpu: remove unused function parameter (stable-fixes).
- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).
- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).
- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).
- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).
- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).
- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).
- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).
- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).
- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).
- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).
- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).
- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).
- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).
- drm/gud: validate TV mode names before creating enum property (git-fixes).
- drm/hibmc: Fix list of formats on the primary plane (git-fixes).
- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).
- drm/i915/hdcp: check streams bounds before overflow (git-fixes).
- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).
- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).
- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).
- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).
- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).
- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).
- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).
- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).
- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).
- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).
- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).
- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).
- drm/nouveau: Use write-combined maps for coherent (git-fixes).
- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).
- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).
- drm/panthor: fix firmware control interface bounds checks (git-fixes).
- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).
- drm/panthor: skip zero-sized firmware sections (git-fixes).
- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).
- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).
- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).
- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).
- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).
- drm/sun4i: Drop node references while building component list (git-fixes).
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).
- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).
- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).
- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).
- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).
- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).
- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).
- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).
- drm/tve200: add OF module alias for autoloading (git-fixes).
- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).
- drm/xe/oa: Check managed mutex initialization errors (git-fixes).
- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).
- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).
- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).
- drm/xe: Order ring writes before ring tail updates (git-fixes).
- drm/xe: Stub out new pagefault layer (stable-fixes).
- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).
- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).
- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).
- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).
- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).
- erspan: Initialize options_len before referencing options (bsc#1274727).
- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).
- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).
- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).
- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).
- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).
- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).
- fbdev: vfb: defer cleanup until the last reference (git-fixes).
- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).
- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).
- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).
- firmware: arm_scmi: Fix requested device removal race (git-fixes).
- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).
- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).
- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).
- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).
- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).
- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).
- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).
- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).
- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).
- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).
- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).
- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).
- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).
- fpga: dfl: fme: add error handling (git-fixes).
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).
- fuse: fix race between interrupt and resend (git-fixes).
- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).
- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).
- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).
- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).
- HID: asus: fix missing hid_is_usb() check (git-fixes).
- HID: asus: simplify RGB init sequence (stable-fixes).
- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).
- HID: core: fix number/pointer type confusion on long items (git-fixes).
- HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes).
- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).
- HID: ft260: validate i2c input report length (stable-fixes).
- HID: hyperv: validate initial device info bounds (git-fixes).
- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes).
- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).
- HID: lg4ff: validate report length before fixed offsets (git-fixes).
- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).
- HID: magicmouse: do not keep a stale msc->input if no input is claimed (git-fixes).
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).
- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).
- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).
- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).
- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).
- HID: nintendo: register input device after capabilities are set (git-fixes).
- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).
- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).
- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).
- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).
- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).
- HID: roccat: bound device-supplied profile index (git-fixes).
- HID: roccat: free buffered reports when destroying device (git-fixes).
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).
- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).
- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).
- HID: synchronize input before cleaning up a failed probe (git-fixes).
- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).
- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).
- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).
- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).
- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).
- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).
- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).
- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).
- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).
- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes).
- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).
- hwmon: (ina2xx) Add support for INA234 (stable-fixes).
- hwmon: (ina2xx) Add support for INA260 (stable-fixes).
- hwmon: (ina2xx) Fix various overflow issues (git-fixes).
- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).
- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).
- hwmon: (ina226) Add support for SY24655 (stable-fixes).
- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).
- hwmon: (ltc4282) Clamp negative current limits (git-fixes).
- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).
- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).
- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).
- hwmon: (max6621) fix temperature clamp range (git-fixes).
- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).
- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).
- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).
- hwrng: omap - Fix probe error path cleanup (git-fixes).
- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).
- i2c: core: fix debugfs UAF on adapter removal (git-fixes).
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).
- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).
- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).
- i2c: ocores: Disable clock on failed resume (git-fixes).
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).
- i3c: dw: rename 'pclk' to 'apb' to match dt-binding (git-fixes).
- i3c: master: Fix device_register() error path (git-fixes).
- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).
- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).
- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).
- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).
- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).
- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).
- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).
- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).
- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).
- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).
- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).
- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).
- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).
- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).
- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).
- iio: light: cm32181: return zero after writing calibscale (git-fixes).
- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).
- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).
- iio: light: isl29028: return zero in write_raw() on success (git-fixes).
- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).
- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).
- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).
- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).
- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).
- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).
- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).
- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).
- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).
- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).
- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).
- Input: cs40l50-vibra - validate custom data from user space (git-fixes).
- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).
- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).
- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).
- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).
- Input: iforce - validate input packet lengths (stable-fixes).
- Input: iqs5xx - validate firmware record destination span (git-fixes).
- Input: mms114 - fix Y-resolution configuration (git-fixes).
- Input: psxpad-spi - set driver data before use (git-fixes).
- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).
- Input: sur40 - fix input device registration ordering (stable-fixes).
- Input: sur40 - fix V4L error path cleanup (stable-fixes).
- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).
- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).
- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).
- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).
- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).
- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).
- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).
- ipmi: ipmb: validate write message length (git-fixes).
- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).
- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).
- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).
- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).
- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).
- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).
- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).
- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).
- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).
- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).
- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).
- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).
- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).
- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).
- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).
- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).
- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).
- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).
- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).
- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).
- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).
- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).
- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).
- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).
- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).
- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).
- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).
- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).
- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).
- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).
- lib/string: fix memchr_inv() for large ranges (git-fixes).
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).
- mac802154: fix data race and NULL deref on local->assoc_dev (git-fixes).
- mac802154: fix netdev use-after-free in beacon worker (git-fixes).
- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).
- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).
- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).
- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).
- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).
- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).
- maple_tree: fix argument name in header (git-fixes).
- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).
- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).
- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).
- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).
- media: cec-pin: Fix event FIFO ordering (git-fixes).
- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).
- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).
- media: cec: Serialize exclusive follower delivery (git-fixes).
- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).
- media: cedrus: clean up media device on probe failure (git-fixes).
- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).
- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).
- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).
- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).
- media: cx231xx: fix devres lifetime (git-fixes).
- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).
- media: cx23885: add ioremap return check and cleanup (git-fixes).
- media: cx23885: cancel NetUP CI work before teardown (git-fixes).
- media: em28xx: defer audio-only extension registration (git-fixes).
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes).
- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).
- media: hevc: add bounded tile-count helpers (git-fixes).
- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).
- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).
- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).
- media: i2c: imx415: Return test pattern write errors (git-fixes).
- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).
- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).
- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).
- media: imx219: Fix maximum frame length in lines (git-fixes).
- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).
- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).
- media: ipu6: Do not free aux device pdata after init (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).
- media: mc-entity: Add missing kerneldoc (git-fixes).
- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).
- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).
- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).
- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).
- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).
- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).
- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).
- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).
- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).
- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).
- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).
- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).
- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).
- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).
- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).
- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).
- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).
- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).
- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).
- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).
- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).
- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).
- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).
- media: s2255: check firmware size before reading trailing marker (git-fixes).
- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).
- media: saa7164: fix cleanup on resource allocation failure (git-fixes).
- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).
- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).
- media: tda18250: fix possible integer overflow (git-fixes).
- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).
- media: usbtv: keep device alive while ALSA card exists (git-fixes).
- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).
- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).
- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).
- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).
- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).
- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).
- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).
- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).
- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).
- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).
- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).
- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).
- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).
- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).
- media: vivid: add vivid_update_reduced_fps() (git-fixes).
- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).
- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).
- media: zoran: Avoid freeing a registered video_device twice (git-fixes).
- mei: pull kvfree out of spinlock (git-fixes).
- mfd: iqs62x: Reject zero-length firmware records (git-fixes).
- mfd: rave-sp: validate received frame payload lengths (git-fixes).
- mfd: sm501: Fix potential memory leaks during remove (git-fixes).
- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).
- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).
- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes).
- misc: nsm: bound the device-reported response length (git-fixes).
- misc: rtsx: add missing write register handling (git-fixes).
- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).
- mkspec-dtb: Move DTS prefix into package list.
- mkspec-dtb: Move provides-obsoletes to package list.
- mkspec-dtb: Put per-architecture package lists into a hash.
- mkspec-dtb: re-indent.
- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).
- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).
- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).
- mtd: afs: validate v2 image info bounds (git-fixes).
- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).
- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).
- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).
- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).
- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).
- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).
- mtd: spinand: fix direct mapping creation sizes (stable-fixes).
- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).
- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).
- mtd: ubi: Release device reference on busy detach (git-fixes).
- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).
- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).
- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
- net: mana: Add handler for sriov configure (bsc#1272756).
- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).
- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).
- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).
- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).
- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).
- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).
- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).
- nfc: digital: Do not dump a NULL response in command completion (git-fixes).
- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).
- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).
- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes).
- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).
- nfc: microread: validate target discovery payload lengths (git-fixes).
- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).
- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).
- nfc: nci: free destination parameters when closing a connection (git-fixes).
- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).
- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).
- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).
- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).
- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).
- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).
- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).
- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).
- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).
- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).
- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).
- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).
- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).
- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).
- perf: Reject exited events as group leaders (git-fixes).
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).
- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).
- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).
- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).
- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).
- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).
- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).
- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).
- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).
- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).
- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).
- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).
- platform/x86: dell-privacy: Fix race condition (git-fixes).
- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).
- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).
- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).
- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).
- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).
- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).
- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).
- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).
- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).
- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).
- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).
- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).
- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).
- platform/x86: ISST: Return error during profile addition (git-fixes).
- platform/x86: ISST: Use PP level enable mask (git-fixes).
- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).
- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).
- platform/x86: ISST: Validate parameter for core power state (git-fixes).
- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).
- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).
- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).
- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).
- power: supply: bd99954: Drop bad register fields (git-fixes).
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).
- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).
- power: supply: bq24257: fix use-after-free on remove (git-fixes).
- power: supply: bq25890: Fix power_supply reference leak (git-fixes).
- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).
- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).
- power: supply: isp1704_charger: cancel work on remove (git-fixes).
- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).
- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).
- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).
- power: supply: max17040: propagate register read errors (git-fixes).
- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).
- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).
- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).
- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).
- power: supply: sc2731_charger: cancel work on remove (git-fixes).
- power: supply: twl4030_charger: cancel workers via devm (git-fixes).
- power: supply: ucs1002: fix use-after-free on remove (git-fixes).
- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).
- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).
- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).
- powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256).
- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752
ltc#221290).
- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).
- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).
- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).
- ppdev: prevent overflow when setting port timeout (git-fixes).
- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).
- rapidio: clear mport->net when rio_add_net() fails (git-fixes).
- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).
- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).
- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).
- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).
- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
- RDMA/mana_ib: unify QP lookup table (git-fixes).
- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).
- regulator: core: use system_freezable_wq for init complete work (git-fixes).
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).
- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes).
- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).
- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).
- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).
- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).
- Revert 'net: thunderbolt: Enable end-to-end flow control also in transmit' (git-fixes).
- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).
- Revert 'wifi: mt76: Disable napi when removing device' (git-fixes).
- rpmsg: core: Fix incorrect return value documentation (git-fixes).
- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).
- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).
- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).
- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).
- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).
- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).
- rtc: zynqmp: Return optional clock lookup errors (git-fixes).
- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).
- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).
- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).
- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).
- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).
- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).
- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).
- scsi: fnic: Bump up version number (bsc#1236344).
- scsi: fnic: Decode firmware role configuration (bsc#1236344).
- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).
- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).
- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).
- scsi: fnic: Make debug logging protocol independent (bsc#1236344).
- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).
- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).
- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).
- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).
- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).
- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).
- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).
- scsi: fnic: Switch to use %ptSp (bsc#1236344).
- scsi: fnic: Track NVMe transport statistics (bsc#1236344).
- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).
- scsi: fnic: Use mempool for receive frames (bsc#1236344).
- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).
- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).
- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).
- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).
- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).
- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).
- serial: amba-pl011: unprepare console clock on unregister (git-fixes).
- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).
- serial: imx: serialize imx_uart_ports lifetime (git-fixes).
- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).
- serial: qcom-geni: do not advance stale DMA completions (git-fixes).
- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).
- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).
- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).
- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).
- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
- slab: Introduce kmalloc_flex() and family (bsc#1280139).
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
- smb: client: harden POSIX SID length parsing (bsc#1273557).
- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).
- smb: client: resolve SWN tcon from live registrations (bsc#1273872).
- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).
- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).
- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).
- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).
- spi: bcm63xx: disable clock on resume failure (git-fixes).
- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).
- spi: davinci: switch to managed controller allocation (git-fixes).
- spi: Fix DMA mapping ownership on partial map failure (git-fixes).
- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).
- spi: oc-tiny: switch to managed controller allocation (git-fixes).
- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).
- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).
- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).
- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).
- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).
- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).
- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).
- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).
- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).
- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).
- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).
- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).
- staging: sm750fb: Add missing Kconfig dependency (git-fixes).
- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).
- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).
- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).
- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).
- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).
- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes).
- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).
- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).
- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).
- tpm: st33zp24: Return zero on status read failure (git-fixes).
- tpm: st33zp24: Validate locality read result (git-fixes).
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).
- tty: clear cdev pointer after cdev_add() failure (git-fixes).
- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).
- tty: skip cdev_del() when no cdev is registered (git-fixes).
- uio: Fix stale info pointer in failed registration path (git-fixes).
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).
- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).
- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).
- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).
- usb: core: Add lock to usb_wakeup_notification() (git-fixes).
- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).
- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).
- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).
- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).
- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).
- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).
- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).
- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).
- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).
- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).
- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).
- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).
- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).
- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).
- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).
- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).
- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).
- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).
- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).
- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).
- usb: gadget: uac: validate rate list length before storing (git-fixes).
- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).
- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).
- usb: mtu3: allow system suspend during active gadget connection (git-fixes).
- usb: musb: omap2430: clean up probe error handling (stable-fixes).
- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).
- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).
- USB: phy: fsl-usb: fix missing static keywords (git-fixes).
- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).
- USB: serial: digi_acceleport: fix port registration order (git-fixes).
- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).
- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).
- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).
- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).
- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).
- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).
- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).
- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).
- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).
- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).
- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).
- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).
- usb: usbtest: disable dynamic ID support (stable-fixes).
- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).
- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).
- vt: add permission check for KDSKBMETA ioctl (stable-fixes).
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).
- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).
- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).
- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).
- watchdog: msc313e: Avoid division by zero (git-fixes).
- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).
- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).
- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).
- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).
- watchdog: msc313e: Fix undefined behavior (git-fixes).
- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).
- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).
- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).
- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).
- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).
- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).
- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).
- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).
- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).
- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).
- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).
- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).
- wifi: cfg80211: validate PMSR measurement type data (git-fixes).
- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).
- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).
- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).
- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).
- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).
- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).
- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).
- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).
- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).
- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).
- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).
- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).
- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).
- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).
- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).
- wifi: mt76: check txfree done event on the WED hw path (git-fixes).
- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).
- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).
- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).
- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).
- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).
- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).
- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).
- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).
- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).
- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).
- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).
- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).
- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).
- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).
- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).
- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).
- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).
- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).
- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).
- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).
- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).
- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).
- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).
- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).
- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).
- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).
- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).
- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).
- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).
- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).
- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).
- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).
- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).
- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).
- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).
- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).
- wifi: rtw89: fix HE extended capability length check (git-fixes).
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).
- x86/virt/tdx: Print TDX module version during init (git-fixes).
- x86/virt/tdx: Retrieve TDX module version (git-fixes).
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).
- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).
- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).
-----------------------------------------------------------------
Advisory ID: 1747
Released: Wed Sep 23 21:42:24 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).
-----------------------------------------------------------------
Advisory ID: 1769
Released: Tue Sep 29 14:25:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: 1792
Released: Wed Sep 30 17:02:45 2026
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References: 1282301
This update for jitterentropy fixes the following issues:
Changes in jitterentropy:
- OSR has to be at least 5 according to current reviews. (bsc#1282301)
-----------------------------------------------------------------
Advisory ID: 1849
Released: Tue Oct 6 15:07:44 2026
Summary: Recommended update for grub2
Type: recommended
Severity: moderate
References: 1278729
This update for grub2 fixes the following issues:
Changes in grub2:
- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)
-----------------------------------------------------------------
Advisory ID: 1897
Released: Sat Oct 10 13:21:45 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:
- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
(bsc#1283183).
Changes for libpng16:
- version update to 1.6.59:
* Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL at users.noreply.github.com>.)
* Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
* Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
* Applied fixes and updates to the CMake build.
* Adopted the REUSE Specification for licensing the CI files.
-----------------------------------------------------------------
Advisory ID: 1904
Released: Mon Oct 12 15:51:59 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1253340,1258335,1260474,1261564,1261816,1264330,1264607,1264747,1266410,1266848,1267464,1267672,1271817,1271901,1271950,1272145,1272215,1272347,1272388,1272473,1272571,1272802,1272803,1272890,1273040,1273059,1273116,1273258,1273275,1273290,1273297,1273320,1273491,1273512,1273784,1273879,1273889,1273938,1273970,1273976,1273982,1274037,1274061,1274245,1274297,1274298,1274316,1274319,1274538,1274629,1274663,1274776,1274818,1274824,1274836,1274890,1274912,1274920,1275137,1275142,1275170,1275495,1275543,1275545,1275549,1275559,1275567,1275682,1275740,1275924,1275953,1275972,1275977,1276007,1276009,1276262,1276287,1276295,1276337,1276338,1276340,1276345,1276347,1276349,1276352,1276353,1276388,1276460,1276461,1276462,1276474,1276475,1276504,1276508,1276519,1276532,1276535,1276538,1276563,1276565,1276570,1276573,1276579,1276783,1276852,1276921,1276923,1276927,1276930,1276947,1277030,1277032,1277036,1277098,1277101,1277109,1277122,1277128,1277129,1277143,1277149,1277153,1277215,1
277217,1277218,1277234,1277245,1277272,1277277,1277296,1277314,1277342,1277371,1277372,1277374,1277379,1277382,1277392,1277396,1277401,1277405,1277410,1277452,1277489,1277493,1277555,1277556,1277557,1277558,1277568,1277615,1277625,1277626,1277640,1277662,1277674,1277705,1277766,1277781,1277784,1277792,1277801,1277805,1277820,1277823,1277824,1277840,1277843,1277844,1277857,1277864,1277885,1277892,1277895,1277896,1277897,1277900,1277904,1277906,1277910,1277913,1277915,1278031,1278035,1278053,1278054,1278056,1278063,1278067,1278087,1278091,1278100,1278191,1278195,1278199,1278205,1278215,1278216,1278225,1278245,1278247,1278255,1278311,1278314,1278315,1278363,1278708,1279116,1279497,1279525,1279527,1279532,1279535,1279536,1279569,1279581,1279590,1279621,1279702,1279786,1279799,1279819,1279835,1279850,1279875,1279878,1279888,1280143,1280146,1280148,1280151,1280163,1280166,1280171,1280178,1280179,1280184,1280193,1280206,1280235,1280237,1280243,1280251,1280252,1280263,1280296,1280298,128029
9,1280303,1280309,1280333,1280334,1280335,1280336,1280338,1280350,1280375,1280379,1280383,1280384,1280387,1280388,1280449,1280451,1280455,1280456,1280464,1280468,1280477,1280487,1280488,1280490,1280494,1280508,1280509,1280518,1280525,1280544,1280546,1280548,1280551,1280576,1280577,1280711,1280716,1280717,1280719,1280720,1280726,1280727,1280733,1280758,1280761,1280766,1280786,1280797,1280870,1280872,1280901,1280920,1280923,1280969,1280985,1280993,1281010,1281014,1281025,1281054,1281057,1281077,1281085,1281136,1281201,1281202,1281224,1281226,1281228,1281229,1281231,1281273,1281295,1281379,1281387,1281399,1281408,1281496,1281514,1281525,1281546,1281597,1281599,1281644,1281645,1281660,1281680,1281682,1281683,1281717,1281732,1281738,1281754,1281777,1281778,1281786,1281789,1281795,1281808,1281825,1281845,1281922,1281955,1281956,1281964,1281973,1281991,1282003,1282013,1282020,1282050,1282054,1282072,1282104,1282110,1282113,1282143,1282147,1282197,1282270,1282271,1282288,1282648,1282672,128
2747,1282774,1282803,1282808,1282812,1282823,1282881,1282891,1282906,1282975,1282997,1283119,1283130,1283149,1283154,1283163,1283166,1283173,1283176,1283201,1283203,1283205,1283213,1283230,1283296,1283312,1283328,1283450,1283475,1283479,1283489,1283490,1283517,1283739,1283794,1283795,1283805,1283880,1283906,1283945,1284146,CVE-2025-40136,CVE-2026-100075,CVE-2026-23199,CVE-2026-23352,CVE-2026-43210,CVE-2026-43272,CVE-2026-43409,CVE-2026-45836,CVE-2026-46044,CVE-2026-46196,CVE-2026-46272,CVE-2026-53377,CVE-2026-53384,CVE-2026-63838,CVE-2026-63881,CVE-2026-63913,CVE-2026-63956,CVE-2026-63983,CVE-2026-64009,CVE-2026-64046,CVE-2026-64070,CVE-2026-64132,CVE-2026-64154,CVE-2026-64173,CVE-2026-64205,CVE-2026-64216,CVE-2026-64235,CVE-2026-64297,CVE-2026-64299,CVE-2026-64324,CVE-2026-64372,CVE-2026-64377,CVE-2026-64388,CVE-2026-64402,CVE-2026-64405,CVE-2026-64414,CVE-2026-64418,CVE-2026-64422,CVE-2026-64448,CVE-2026-64457,CVE-2026-64473,CVE-2026-64474,CVE-2026-64475,CVE-2026-64476,CVE-2026-64
580,CVE-2026-64594,CVE-2026-64597,CVE-2026-64598,CVE-2026-68146,CVE-2026-68162,CVE-2026-68264,CVE-2026-68266,CVE-2026-68290,CVE-2026-68312,CVE-2026-68343,CVE-2026-68367,CVE-2026-68376,CVE-2026-68382,CVE-2026-68385,CVE-2026-68400,CVE-2026-68441,CVE-2026-68451,CVE-2026-68452,CVE-2026-68454,CVE-2026-68471,CVE-2026-68477,CVE-2026-72012,CVE-2026-72018,CVE-2026-72025,CVE-2026-72066,CVE-2026-72070,CVE-2026-72098,CVE-2026-72102,CVE-2026-72128,CVE-2026-72129,CVE-2026-72130,CVE-2026-72147,CVE-2026-72166,CVE-2026-72218,CVE-2026-72219,CVE-2026-72224,CVE-2026-72237,CVE-2026-72247,CVE-2026-72256,CVE-2026-72299,CVE-2026-72321,CVE-2026-72322,CVE-2026-72348,CVE-2026-72349,CVE-2026-72351,CVE-2026-72352,CVE-2026-72383,CVE-2026-72392,CVE-2026-72404,CVE-2026-72406,CVE-2026-72413,CVE-2026-72433,CVE-2026-72434,CVE-2026-72435,CVE-2026-72436,CVE-2026-72444,CVE-2026-72447,CVE-2026-72491,CVE-2026-74256,CVE-2026-74257,CVE-2026-74258,CVE-2026-74267,CVE-2026-74268,CVE-2026-74281,CVE-2026-74283,CVE-2026-74288,CVE
-2026-74289,CVE-2026-74290,CVE-2026-74330,CVE-2026-74356,CVE-2026-74359,CVE-2026-74365,CVE-2026-74376,CVE-2026-74384,CVE-2026-74385,CVE-2026-74386,CVE-2026-74389,CVE-2026-74391,CVE-2026-74398,CVE-2026-74440,CVE-2026-74449,CVE-2026-74450,CVE-2026-74465,CVE-2026-74467,CVE-2026-74469,CVE-2026-74471,CVE-2026-74473,CVE-2026-74480,CVE-2026-74483,CVE-2026-74484,CVE-2026-74485,CVE-2026-74487,CVE-2026-74490,CVE-2026-74492,CVE-2026-74493,CVE-2026-74515,CVE-2026-74538,CVE-2026-74564,CVE-2026-74579,CVE-2026-74580,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74590,CVE-2026-74592,CVE-2026-74594,CVE-2026-74595,CVE-2026-74597,CVE-2026-74600,CVE-2026-74601,CVE-2026-74602,CVE-2026-74603,CVE-2026-74605,CVE-2026-74606,CVE-2026-74609,CVE-2026-74625,CVE-2026-74628,CVE-2026-74630,CVE-2026-74631,CVE-2026-74632,CVE-2026-74634,CVE-2026-74636,CVE-2026-74637,CVE-2026-74638,CVE-2026-74659,CVE-2026-74660,CVE-2026-74662,CVE-2026-74663,CVE-2026-74666,CVE-2026-74667,CVE-2026-74671,CVE-2026-74688,CVE-2026-7
4689,CVE-2026-74692,CVE-2026-74694,CVE-2026-74696,CVE-2026-74697,CVE-2026-74700,CVE-2026-74701,CVE-2026-74710,CVE-2026-74713,CVE-2026-74718,CVE-2026-74725,CVE-2026-74726,CVE-2026-74735,CVE-2026-74739,CVE-2026-74745,CVE-2026-74752,CVE-2026-80521,CVE-2026-80585,CVE-2026-80613,CVE-2026-80631,CVE-2026-80664,CVE-2026-80679,CVE-2026-80686,CVE-2026-80694,CVE-2026-80715,CVE-2026-80725,CVE-2026-80747,CVE-2026-80756,CVE-2026-80779,CVE-2026-80789,CVE-2026-80793,CVE-2026-80836,CVE-2026-80840,CVE-2026-80841,CVE-2026-80842,CVE-2026-80844,CVE-2026-80846,CVE-2026-80847,CVE-2026-80848,CVE-2026-80851,CVE-2026-80852,CVE-2026-80863,CVE-2026-80864,CVE-2026-80865,CVE-2026-80880,CVE-2026-80895,CVE-2026-80932,CVE-2026-80976,CVE-2026-80979,CVE-2026-80980,CVE-2026-80983,CVE-2026-80984,CVE-2026-81000,CVE-2026-81001,CVE-2026-89448,CVE-2026-89451,CVE-2026-89453,CVE-2026-89477,CVE-2026-89479,CVE-2026-89480,CVE-2026-89481,CVE-2026-89482,CVE-2026-89485,CVE-2026-89500,CVE-2026-89501,CVE-2026-89502,CVE-2026-89503,CV
E-2026-89508,CVE-2026-89510,CVE-2026-89511,CVE-2026-89525,CVE-2026-89526,CVE-2026-89527,CVE-2026-89530,CVE-2026-89531,CVE-2026-89532,CVE-2026-89533,CVE-2026-89534,CVE-2026-89535,CVE-2026-89536,CVE-2026-89538,CVE-2026-89539,CVE-2026-89540,CVE-2026-89541,CVE-2026-89542,CVE-2026-89544,CVE-2026-89545,CVE-2026-89547,CVE-2026-89548,CVE-2026-89550,CVE-2026-89551,CVE-2026-89564,CVE-2026-89569,CVE-2026-89580,CVE-2026-89603,CVE-2026-89644,CVE-2026-89658,CVE-2026-89660,CVE-2026-89662,CVE-2026-89663,CVE-2026-89665,CVE-2026-89669,CVE-2026-89671,CVE-2026-89672,CVE-2026-89673,CVE-2026-89674,CVE-2026-89680,CVE-2026-89683,CVE-2026-89684,CVE-2026-89685,CVE-2026-89686,CVE-2026-89688,CVE-2026-89690,CVE-2026-89691,CVE-2026-89694,CVE-2026-89696,CVE-2026-89697,CVE-2026-89698,CVE-2026-89699,CVE-2026-89702,CVE-2026-89703,CVE-2026-89704,CVE-2026-89705,CVE-2026-89706,CVE-2026-89707,CVE-2026-89710,CVE-2026-89712,CVE-2026-89713,CVE-2026-89747,CVE-2026-89780,CVE-2026-89784,CVE-2026-89789,CVE-2026-89791,CVE-2026-
89798,CVE-2026-89912,CVE-2026-89913,CVE-2026-89968,CVE-2026-89970,CVE-2026-89984,CVE-2026-90003,CVE-2026-90065,CVE-2026-90074,CVE-2026-90097,CVE-2026-90101,CVE-2026-90104,CVE-2026-90142,CVE-2026-90149,CVE-2026-90150,CVE-2026-90151,CVE-2026-90177,CVE-2026-90182,CVE-2026-90183,CVE-2026-90203,CVE-2026-90218,CVE-2026-90228,CVE-2026-90240,CVE-2026-90241,CVE-2026-90243,CVE-2026-90259,CVE-2026-90263,CVE-2026-90265,CVE-2026-90292,CVE-2026-90293,CVE-2026-90294,CVE-2026-90307,CVE-2026-90308,CVE-2026-90309,CVE-2026-90358,CVE-2026-90388,CVE-2026-90413,CVE-2026-90414,CVE-2026-90415,CVE-2026-90417,CVE-2026-90426,CVE-2026-90428,CVE-2026-90430,CVE-2026-92495,CVE-2026-92523,CVE-2026-92525,CVE-2026-93037,CVE-2026-93107,CVE-2026-93108,CVE-2026-93109,CVE-2026-93110,CVE-2026-93154,CVE-2026-93160,CVE-2026-93207,CVE-2026-93212,CVE-2026-93264,CVE-2026-93782,CVE-2026-93794,CVE-2026-93800,CVE-2026-93810,CVE-2026-93814,CVE-2026-93825,CVE-2026-93826,CVE-2026-93827,CVE-2026-93829,CVE-2026-97413,CVE-2026-97421,C
VE-2026-97477,CVE-2026-97520,CVE-2026-97521,CVE-2026-97543,CVE-2026-97544,CVE-2026-97545,CVE-2026-97546,CVE-2026-97552,CVE-2026-97557,CVE-2026-97571,CVE-2026-97572,CVE-2026-97573,CVE-2026-97574,CVE-2026-97605,CVE-2026-97902,CVE-2026-97934,CVE-2026-97940,CVE-2026-97947,CVE-2026-97957,CVE-2026-98003,CVE-2026-98028,CVE-2026-98029,CVE-2026-98030,CVE-2026-98091
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
(bsc#1272890).
- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
- CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).
- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).
- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).
- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).
- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).
- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).
- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).
- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).
- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).
- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).
- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).
- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).
- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).
- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).
- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).
- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).
- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).
- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).
- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).
- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).
- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).
- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).
- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).
- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
- CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c (bsc#1276947).
- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).
- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).
- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).
- CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).
- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).
- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).
- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).
- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).
- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).
- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).
- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).
- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).
- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).
- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).
- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).
- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).
- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).
- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).
- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).
- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).
- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).
- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).
- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).
- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).
- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).
- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).
- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).
- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).
- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).
- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).
- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).
- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).
- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).
- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).
- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).
- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).
- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).
- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).
- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).
- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).
- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).
- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).
- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).
- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).
- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).
- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).
- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).
- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).
- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).
- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).
- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).
- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).
- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).
- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).
- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).
- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).
- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).
- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).
- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
- CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383).
- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).
- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).
- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).
- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).
- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).
- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).
- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).
- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).
- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).
- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).
- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).
- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).
- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).
- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).
- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).
- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).
- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).
- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).
- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).
- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).
- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).
- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).
- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).
- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).
- CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252).
- CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235).
- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).
- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).
- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).
- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).
- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).
- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).
- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).
- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).
- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).
- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).
- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).
- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).
- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).
- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).
- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).
- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).
- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).
- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).
- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).
- CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames (bsc#1280969).
- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).
- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).
- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).
- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).
- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).
- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).
- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).
- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).
- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).
- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).
- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).
- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).
- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).
- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).
- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).
- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).
- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).
- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).
- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).
- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).
- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).
- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).
- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).
- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).
- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).
- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).
- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).
- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).
- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).
- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).
- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).
- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).
- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).
- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).
- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).
- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.
- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().
- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).
- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).
- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).
- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).
- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).
- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).
- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).
- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).
- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).
- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).
- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).
- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).
- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).
- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).
- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).
- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).
- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).
- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).
- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).
- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).
- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).
- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).
- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).
- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).
- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).
- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).
- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).
- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).
- ACPICA: add boundary checks in two places (stable-fixes).
- ACPICA: Add package limit checks in parser functions (stable-fixes).
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).
- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).
- ACPICA: Prevent adding invalid references (stable-fixes).
- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).
- ACPICA: validate handler object type in two places (stable-fixes).
- ALSA: 6fire: Clean ups with guard() (stable-fixes).
- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).
- ALSA: aloop: Check card index validity at probe (stable-fixes).
- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).
- ALSA: caiaq: unregister the input device when probe fails (git-fixes).
- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).
- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).
- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).
- ALSA: es18xx: check control allocation before private data setup (stable-fixes).
- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).
- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).
- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).
- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).
- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).
- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).
- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).
- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).
- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).
- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).
- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).
- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).
- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).
- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).
- ALSA: line6: reject oversized playback packets (git-fixes).
- ALSA: mpu401: Check card index validity at probe (stable-fixes).
- ALSA: mts64: Check card index validity at probe (stable-fixes).
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).
- ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes).
- ALSA: portman2x4: Check card index validity at probe (stable-fixes).
- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).
- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).
- ALSA: seq: Serialize compat port-info ioctls (git-fixes).
- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).
- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).
- ALSA: ump: Copy FB name string more safely (stable-fixes).
- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).
- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).
- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).
- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).
- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).
- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).
- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).
- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).
- ALSA: virmidi: Check card index validity at probe (stable-fixes).
- ALSA: virtio: reset device before deleting virtqueues (git-fixes).
- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).
- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).
- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).
- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
- arm64: percpu: Fix this_cpu_write() casting (git-fixes).
- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).
- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).
- ASoC: codecs: aw88261: reduce log spam (stable-fixes).
- ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).
- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).
- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (git-fixes).
- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).
- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).
- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).
- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).
- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).
- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).
- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).
- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).
- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).
- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).
- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).
- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).
- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).
- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).
- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).
- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).
- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).
- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).
- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).
- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).
- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).
- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).
- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).
- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).
- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).
- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).
- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).
- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).
- Bluetooth: eir: validate service data length before reading UUID (git-fixes).
- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).
- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).
- Bluetooth: hci_core: Print number of packets in conn->data_q (stable-fixes).
- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).
- Bluetooth: hci_sock: validate event length before filtering (git-fixes).
- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).
- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).
- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).
- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).
- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).
- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).
- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).
- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes).
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).
- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).
- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).
- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).
- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).
- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).
- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).
- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).
- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).
- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).
- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default
configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
- dmaengine: Add devm_dma_request_chan() (stable-fixes).
- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).
- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).
- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).
- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).
- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).
- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).
- driver core: Export get_dev_from_fwnode() (stable-fixes).
- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).
- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).
- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).
- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).
- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).
- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).
- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).
- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).
- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).
- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).
- drm/amdgpu: check ras and obj before dereference (git-fixes).
- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).
- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).
- drm/amdgpu: Failed to check various return code (stable-fixes).
- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).
- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).
- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).
- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).
- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).
- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).
- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).
- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).
- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).
- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).
- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes).
- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).
- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).
- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).
- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).
- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).
- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).
- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).
- drm/cirrus: Use video aperture helpers (stable-fixes).
- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).
- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).
- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).
- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).
- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).
- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).
- drm/i915: fix incorrect RCU teardown order (git-fixes).
- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).
- drm/imagination: clamp freelist reconstruction requests (git-fixes).
- drm/imagination: Fix page count for page table for map() interface (git-fixes).
- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).
- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).
- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).
- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).
- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).
- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).
- drm/msm: Recover HW before retire hung submit (git-fixes).
- drm/nouveau/bios: skip the IFR header if present (stable-fixes).
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).
- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).
- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).
- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).
- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).
- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).
- drm/omap: dsi: Do not copy isr table (git-fixes).
- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).
- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).
- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).
- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).
- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).
- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).
- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).
- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).
- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).
- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).
- drm: add drm_memory_stats_is_zero (stable-fixes).
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).
- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).
- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).
- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).
- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).
- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).
- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).
- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).
- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).
- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).
- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).
- gpio: tps65219: Fix GPIO input value reads (git-fixes).
- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).
- gpio: zynq: fix runtime PM leak on request error path (git-fixes).
- HID: alps: fix use-after-free on input2 registration failure (git-fixes).
- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).
- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).
- HID: asus: fortify keyboard handshake (stable-fixes).
- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).
- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).
- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).
- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).
- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).
- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).
- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).
- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).
- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).
- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).
- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).
- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).
- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).
- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).
- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).
- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).
- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).
- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).
- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).
- hwmon: (w83793) release probe data through kref (git-fixes).
- i2c: at91: release DMA channels on remove and probe error (git-fixes).
- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).
- i2c: imx: disable autosuspend on remove (git-fixes).
- i2c: imx: release DMA channels on probe error (git-fixes).
- i2c: mxs: fix DMA channel leak on probe error (git-fixes).
- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).
- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).
- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).
- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).
- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).
- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).
- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).
- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).
- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).
- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).
- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).
- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).
- iio: accel: sca3000: fix frequency divider condition check (git-fixes).
- iio: adc: pac1934: check ACPI label duplication (git-fixes).
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).
- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).
- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).
- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).
- iio: buffer: serialize buffer teardown with mode claims (git-fixes).
- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).
- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).
- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).
- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).
- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).
- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).
- iio: proximity: aw96103: validate firmware data length (git-fixes).
- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).
- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).
- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).
- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).
- Input: aiptek - validate raw macro indices before updating state (stable-fixes).
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).
- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).
- Input: eeti_ts - publish the OF module alias (git-fixes).
- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).
- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).
- Input: soc_button_array - check btns_desc->package.count (git-fixes).
- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).
- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).
- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).
- Input: xpad - add support for Azeron devices (stable-fixes).
- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).
- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).
- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).
- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.
- kernel-binary.spec.in: Fix syntax error.
- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).
- keys: fix lost wakeup when reaping a dead key type (git-fixes).
- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).
- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).
- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).
- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).
- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).
- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).
- KVM: nVMX: Always flush vpid02 on first use (git-fixes).
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).
- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).
- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).
- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).
- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).
- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).
- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).
- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).
- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).
- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).
- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).
- media: i2c: imx355: Replace client->dev usage (stable-fixes).
- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).
- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).
- media: qcom: camss: avoid format string warning (stable-fixes).
- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).
- media: video-i2c: fix buffer queue ordering (stable-fixes).
- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).
- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).
- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).
- mfd: rsmu: Add 8a34002 support (stable-fixes).
- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).
- mmc: core: Add validation for host-provided max_segs (stable-fixes).
- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).
- mmc: core: Fix OF node reference leak on card add failure (git-fixes).
- mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes).
- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).
- mmc: hsq: Fix use-after-free in retry work (git-fixes).
- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).
- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).
- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).
- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).
- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).
- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).
- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).
- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).
- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).
- mtd: core: call _get_device() with the master MTD (git-fixes).
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).
- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).
- mtd: rawnand: pl353: Fix debug prints (git-fixes).
- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).
- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).
- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).
- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).
- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).
- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).
- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).
- net: usb: sr9700: include receive overhead in the length check (git-fixes).
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).
- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).
- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).
- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).
- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).
- nfc: nfcmrvl: validate helper command length before pull (git-fixes).
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).
- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).
- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).
- nfc: st21nfca: validate received frame size (git-fixes).
- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).
- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).
- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).
- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).
- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).
- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).
- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).
- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).
- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).
- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).
- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).
- PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes).
- PCI: xgene: Drop unnecessary OF node reference (git-fixes).
- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).
- pinctrl: meson: Fix typo in s4 group name (git-fixes).
- pinctrl: single: free the IRQ on domain creation failure (git-fixes).
- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).
- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).
- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).
- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).
- platform/x86: ISST: Validate max level for set feature (git-fixes).
- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).
- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).
- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).
- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).
- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).
- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).
- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).
- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).
- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).
- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).
- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).
- powerpc: Add Power12 architected mode (jsc#PED-16906).
- powerpc: Add Power12 raw mode (jsc#PED-16906).
- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).
- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
- RDMA/core: Fix potential use after free in counter_release() (git-fixes).
- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).
- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).
- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).
- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).
- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).
- RDMA/hfi1: Create workqueues before device initialization (git-fixes).
- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).
- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).
- RDMA/hfi1: Free RX data on late probe failure (git-fixes).
- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).
- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).
- RDMA/hfi1: Preserve unit 0 on (git-fixes).
- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).
- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).
- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).
- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).
- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).
- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).
- RDMA/rvt: Return NULL after port allocation failure (git-fixes).
- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).
- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).
- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).
- rtc: ac100: Assign .num before accessing .hws (git-fixes).
- rtc: aspeed: add AST2700 compatible (stable-fixes).
- rtc: bq32000: add delay between RTC reads (stable-fixes).
- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).
- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).
- rtc: mv: add suspend/resume support for wakeup (stable-fixes).
- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).
- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).
- serial: 8250: fix possible ISR soft lockup (stable-fixes).
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).
- serial: fix TIOCMIWAIT race (git-fixes).
- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).
- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).
- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).
- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).
- soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes).
- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).
- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).
- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).
- soundwire: only handle alert events when the peripheral is attached (stable-fixes).
- soundwire: validate DT compatible before parsing it (stable-fixes).
- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).
- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).
- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).
- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).
- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).
- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).
- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).
- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).
- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).
- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).
- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).
- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).
- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).
- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).
- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).
- thunderbolt: Reject oversized XDomain properties responses (git-fixes).
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).
- thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes).
- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).
- tpm: Disable TPM on null key name mismatch (git-fixes).
- tty: serial: max3100: shut down timer before freeing port (git-fixes).
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).
- tty: vt: fix memory leak in vc_allocate() (git-fixes).
- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).
- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).
- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).
- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).
- usb: cdns3: rename hibernated argument of role->resume() to lost_power (stable-fixes).
- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).
- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).
- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).
- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).
- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes).
- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).
- usb: gadget: udc: skip pullup() if already connected (stable-fixes).
- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).
- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).
- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).
- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).
- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).
- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).
- usb: ohci-st: disable controller wakeup on removal (git-fixes).
- USB: serial: fix driver deregistration order (git-fixes).
- USB: serial: fix dynamic id driver deregistration race (git-fixes).
- USB: serial: fix ioctl hangup race (git-fixes).
- USB: serial: fix port tear down use-after-free (git-fixes).
- USB: serial: quatech2: fix baud rate overflow (git-fixes).
- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).
- USB: serial: ssu100: fix baud rate overflow (git-fixes).
- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).
- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).
- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).
- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).
- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).
- usb: usbtmc: don't store usb_device_id (stable-fixes).
- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).
- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).
- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).
- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).
- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).
- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: digicolor: Avoid division by zero (git-fixes).
- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).
- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).
- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).
- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).
- watchdog: msc313e: Propagate error code in resume() (git-fixes).
- watchdog: rtd119x: Avoid division by zero (git-fixes).
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).
- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).
- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).
- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).
- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).
- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).
- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).
- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).
- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).
- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).
- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).
- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).
- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).
- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).
- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).
- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).
- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).
- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).
- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).
- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).
- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).
- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).
- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).
- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).
- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).
- wifi: libertas: reject short monitor TX frames (stable-fixes).
- wifi: libipw: fix key index receive bound checks (stable-fixes).
- wifi: libipw: reject too-short association responses (git-fixes).
- wifi: libipw: reject too-short beacon and probe responses (git-fixes).
- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).
- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).
- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).
- wifi: mac80211: don't access the TSF of a down interface (git-fixes).
- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).
- wifi: mac80211: don't allow link changes when iface is down (git-fixes).
- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).
- wifi: mac80211: don't start a ROC while scanning (git-fixes).
- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).
- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).
- wifi: mac80211: mesh: release the channel if start fails (git-fixes).
- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).
- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).
- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).
- wifi: mac80211: reset state when starting AP fails (git-fixes).
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).
- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).
- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).
- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).
- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).
- wifi: mt76: add init_wiphy callback (stable-fixes).
- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).
- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).
- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).
- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).
- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).
- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).
- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).
- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).
- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).
- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).
- wifi: mwifiex: validate action frame fixed fields (git-fixes).
- wifi: mwifiex: validate scan response extents (git-fixes).
- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).
- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).
- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).
- wifi: rsi: fix heap OOB write on key removal (git-fixes).
- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).
- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes).
- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).
- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).
- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).
- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).
- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).
- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).
- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).
- wifi: virt_wifi: don't transfer operstate before register (git-fixes).
- wifi: virt_wifi: free skb when disconnected (git-fixes).
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).
- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).
- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).
-----------------------------------------------------------------
Advisory ID: 1909
Released: Tue Oct 13 17:13:54 2026
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
Changes in rpm:
- Do not dependent on python3-base, it is perfectly OK to use
any Python interpreter for python-rpm-packaging.
- Remove obsolete Python2-based removal of Python directories.
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
The following package changes have been done:
- SLES_image-release-16.0-160000.2.13 updated
- libpng16-16-1.6.59-160000.1.1 updated
- rpm-4.20.1-160000.4.1 updated
- grub2-common-2.12-160000.8.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
- grub2-x86_64-efi-2.12-160000.8.1 updated
- grub2-i386-pc-2.12-160000.8.1 updated
- grub2-2.12-160000.8.1 updated
- kernel-default-6.12.0-160000.39.1 updated
- container:elemental-base-os-common-16.0-4.13-16.0-4.13-4.13 added
- container:elemental-base-os-common-16.0-4.1-16.0-4.1-4.1 removed
More information about the sle-container-updates
mailing list