SUSE-CU-2026:10907-1: Security update of bci/bci-sle15-kernel-module-devel
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Sep 19 10:09:13 UTC 2026
SUSE Container Update Advisory: bci/bci-sle15-kernel-module-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:10907-1
Container Tags : bci/bci-sle15-kernel-module-devel:15.7 , bci/bci-sle15-kernel-module-devel:15.7-61.21 , bci/bci-sle15-kernel-module-devel:latest
Container Release : 61.21
Severity : important
Type : security
References : 1230238 1235944 1236344 1240957 1241363 1247180 1247455 1249104
1250748 1251130 1251966 1252682 1253454 1254306 1255225 1255250
1256629 1256708 1257055 1257154 1258430 1258472 1258517 1260522
1261562 1261780 1262073 1262432 1263004 1263052 1263061 1263133
1263864 1264010 1264012 1264335 1264446 1264541 1264587 1264619
1264643 1264740 1264807 1265068 1265121 1265220 1265449 1265928
1266402 1266860 1266874 1266897 1267023 1267236 1267238 1267501
1267505 1267610 1267612 1268276 1268972 1268979 1268987 1269004
1269013 1269108 1269113 1269114 1269126 1269140 1269167 1269234
1269238 1269242 1269256 1269301 1269306 1269313 1269381 1269388
1269402 1269412 1269530 1269579 1269590 1269635 1269647 1269655
1269665 1269686 1269695 1269713 1269731 1269774 1269783 1269792
1269815 1269888 1269965 1269969 1269981 1269985 1270090 1270108
1270111 1270251 1270263 1270268 1271256 1271365 1271366 1271825
1271830 1272150 1272175 1272179 1272182 1272200 1272210 1272213
1272230 1272260 1272261 1272262 1272297 1272346 1272351 1272359
1272381 1272383 1272385 1272390 1272423 1272429 1272484 1272486
1272497 1272502 1272516 1272569 1272571 1272618 1272641 1272643
1272662 1272673 1272680 1272682 1272756 1272786 1272788 1272798
1272799 1272804 1272868 1272877 1272891 1272893 1272963 1272983
1272993 1273005 1273008 1273019 1273027 1273028 1273030 1273032
1273033 1273036 1273037 1273038 1273053 1273054 1273060 1273105
1273134 1273249 1273250 1273260 1273273 1273274 1273276 1273277
1273280 1273281 1273284 1273285 1273289 1273291 1273294 1273302
1273303 1273305 1273310 1273311 1273316 1273318 1273319 1273323
1273325 1273327 1273334 1273335 1273336 1273337 1273338 1273340
1273341 1273346 1273422 1273426 1273443 1273460 1273463 1273465
1273468 1273469 1273471 1273479 1273480 1273482 1273484 1273488
1273490 1273501 1273503 1273504 1273506 1273523 1273525 1273533
1273536 1273542 1273555 1273578 1273579 1273581 1273582 1273596
1273597 1273598 1273600 1273601 1273602 1273603 1273679 1273681
1273682 1273734 1273738 1273739 1273741 1273742 1273743 1273745
1273748 1273749 1273755 1273762 1273765 1273766 1273769 1273774
1273778 1273780 1273790 1273796 1273797 1273801 1273804 1273810
1273811 1273812 1273813 1273817 1273822 1273824 1273831 1273832
1273834 1273838 1273844 1273849 1273859 1273860 1273862 1273867
1273868 1273869 1273872 1273876 1273877 1273880 1273882 1273890
1273891 1273892 1273895 1273896 1273903 1273905 1273930 1273933
1273934 1273935 1273936 1273939 1273940 1273941 1273942 1273944
1273945 1273946 1273956 1273957 1273958 1273966 1273967 1273968
1273972 1273974 1273975 1273977 1273982 1273988 1273990 1273991
1273995 1274001 1274003 1274006 1274008 1274009 1274010 1274011
1274012 1274014 1274017 1274019 1274020 1274026 1274028 1274030
1274031 1274035 1274040 1274041 1274055 1274057 1274058 1274061
1274063 1274065 1274067 1274071 1274075 1274076 1274077 1274078
1274208 1274226 1274239 1274243 1274258 1274264 1274265 1274267
1274274 1274277 1274278 1274281 1274283 1274286 1274290 1274294
1274295 1274296 1274297 1274298 1274314 1274321 1274491 1274497
1274539 1274541 1274543 1274545 1274547 1274550 1274573 1274578
1274580 1274581 1274620 1274622 1274624 1274629 1274632 1274636
1274639 1274640 1274642 1274644 1274645 1274646 1274649 1274650
1274651 1274656 1274659 1274662 1274663 1274665 1274667 1274670
1274675 1274677 1274678 1274679 1274681 1274682 1274690 1274694
1274696 1274698 1274699 1274700 1274702 1274703 1274705 1274706
1274709 1274710 1274713 1274716 1274721 1274723 1274725 1274726
1274737 1274738 1274749 1274752 1274753 1274754 1274755 1274756
1274764 1274768 1274770 1274783 1274787 1274800 1274801 1274802
1274804 1274805 1274807 1274808 1274811 1274813 1274814 1274831
1274834 1274835 1274847 1274849 1274853 1274868 1274869 1274872
1274873 1274874 1274876 1274877 1274879 1274881 1274883 1274886
1274888 1274891 1274892 1274893 1274894 1274895 1274896 1274897
1274898 1274899 1274901 1274902 1274905 1274906 1274907 1274908
1274913 1274914 1274920 1274921 1274924 1274925 1274929 1274930
1274933 1274934 1274935 1274941 1274945 1274947 1274951 1274953
1274958 1274968 1274981 1275040 1275069 1275071 1275073 1275076
1275080 1275081 1275083 1275088 1275091 1275125 1275126 1275131
1275132 1275139 1275141 1275146 1275148 1275149 1275150 1275152
1275154 1275155 1275156 1275157 1275158 1275161 1275163 1275164
1275169 1275173 1275176 1275185 1275190 1275192 1275236 1275237
1275239 1275294 1275300 1275301 1275303 1275304 1275305 1275306
1275307 1275470 1275472 1275474 1275479 1275483 1275486 1275487
1275506 1275509 1275511 1275517 1275519 1275528 1275535 1275540
1275553 1275555 1275557 1275561 1275566 1275569 1275572 1275574
1275578 1275582 1275583 1275584 1275591 1275595 1275633 1275636
1275650 1275656 1275659 1275665 1275669 1275687 1275688 1275695
1275696 1275704 1275737 1275782 1275784 1275787 1275788 1275789
1275790 1275797 1275798 1275805 1275817 1275818 1275819 1275820
1275821 1275822 1275823 1275827 1275864 1275867 1275869 1275870
1275871 1275872 1275886 1275905 1275923 1275925 1275928 1275946
1275950 1275954 1275970 1275973 1275975 1275976 1276029 1276257
1276263 1276270 1276273 1276277 1276335 1276346 1276350 1276355
1276446 1276452 1276500 1276507 1276542 1276546 1276551 1276552
1276561 1276569 1276577 1276665 1276864 1276892 1276912 1276913
1276927 1276931 1276937 1276941 1276943 1276944 1276946 1276955
1276961 1277022 1277034 1277037 1277047 1277054 1277057 1277059
1277064 1277066 1277069 1277073 1277077 1277095 1277155 1277159
1277160 1277202 1277204 1277262 1277275 1277285 1277391 1277408
1277516 1277523 1277551 1277625 1277660 1277678 1277688 1277707
1277708 1277709 1277710 1277711 1277713 1277775 1277776 1277921
1277922 1279893 1280050 1280051 1280052 1280053 1280054 CVE-2024-44981
CVE-2024-57841 CVE-2025-23137 CVE-2025-38469 CVE-2025-39939 CVE-2025-39964
CVE-2025-40022 CVE-2025-40199 CVE-2025-68179 CVE-2025-68214 CVE-2025-71075
CVE-2025-71104 CVE-2026-18374 CVE-2026-19499 CVE-2026-19542 CVE-2026-23210
CVE-2026-23227 CVE-2026-23230 CVE-2026-23454 CVE-2026-31418 CVE-2026-31531
CVE-2026-31557 CVE-2026-31658 CVE-2026-31663 CVE-2026-43014 CVE-2026-43015
CVE-2026-43116 CVE-2026-43125 CVE-2026-43163 CVE-2026-43213 CVE-2026-43271
CVE-2026-43273 CVE-2026-43363 CVE-2026-43386 CVE-2026-43416 CVE-2026-43448
CVE-2026-45897 CVE-2026-45968 CVE-2026-46070 CVE-2026-46078 CVE-2026-46091
CVE-2026-46107 CVE-2026-46115 CVE-2026-46127 CVE-2026-46195 CVE-2026-52920
CVE-2026-52925 CVE-2026-52929 CVE-2026-52935 CVE-2026-52939 CVE-2026-52946
CVE-2026-52975 CVE-2026-52977 CVE-2026-52990 CVE-2026-52994 CVE-2026-53001
CVE-2026-53033 CVE-2026-53034 CVE-2026-53059 CVE-2026-53076 CVE-2026-53077
CVE-2026-53089 CVE-2026-53091 CVE-2026-53094 CVE-2026-53096 CVE-2026-53110
CVE-2026-53111 CVE-2026-53126 CVE-2026-53142 CVE-2026-53154 CVE-2026-53163
CVE-2026-53180 CVE-2026-53207 CVE-2026-53219 CVE-2026-53220 CVE-2026-53223
CVE-2026-53228 CVE-2026-53238 CVE-2026-53260 CVE-2026-53263 CVE-2026-53264
CVE-2026-53269 CVE-2026-53273 CVE-2026-53309 CVE-2026-53330 CVE-2026-53336
CVE-2026-53337 CVE-2026-53353 CVE-2026-53365 CVE-2026-53366 CVE-2026-53381
CVE-2026-53388 CVE-2026-6368 CVE-2026-63801 CVE-2026-63808 CVE-2026-63810
CVE-2026-63823 CVE-2026-63827 CVE-2026-63828 CVE-2026-63842 CVE-2026-63850
CVE-2026-63860 CVE-2026-63865 CVE-2026-63868 CVE-2026-63879 CVE-2026-63881
CVE-2026-63886 CVE-2026-63887 CVE-2026-63888 CVE-2026-63889 CVE-2026-63891
CVE-2026-63898 CVE-2026-63920 CVE-2026-63923 CVE-2026-63925 CVE-2026-63926
CVE-2026-63928 CVE-2026-63937 CVE-2026-63944 CVE-2026-63969 CVE-2026-63970
CVE-2026-63972 CVE-2026-63973 CVE-2026-63980 CVE-2026-63985 CVE-2026-63990
CVE-2026-63992 CVE-2026-63995 CVE-2026-63996 CVE-2026-63997 CVE-2026-63998
CVE-2026-63999 CVE-2026-64000 CVE-2026-64001 CVE-2026-64002 CVE-2026-64004
CVE-2026-64005 CVE-2026-64006 CVE-2026-64007 CVE-2026-64010 CVE-2026-64011
CVE-2026-64014 CVE-2026-64015 CVE-2026-64018 CVE-2026-64021 CVE-2026-64029
CVE-2026-64033 CVE-2026-64034 CVE-2026-64039 CVE-2026-64047 CVE-2026-64048
CVE-2026-64051 CVE-2026-64052 CVE-2026-64055 CVE-2026-64056 CVE-2026-64073
CVE-2026-64083 CVE-2026-64084 CVE-2026-64085 CVE-2026-64086 CVE-2026-64087
CVE-2026-64088 CVE-2026-64097 CVE-2026-64098 CVE-2026-64099 CVE-2026-64102
CVE-2026-64109 CVE-2026-64112 CVE-2026-64113 CVE-2026-64114 CVE-2026-64115
CVE-2026-64118 CVE-2026-64121 CVE-2026-64125 CVE-2026-64126 CVE-2026-64127
CVE-2026-64128 CVE-2026-64131 CVE-2026-64133 CVE-2026-64134 CVE-2026-64135
CVE-2026-64136 CVE-2026-64137 CVE-2026-64144 CVE-2026-64146 CVE-2026-64148
CVE-2026-64155 CVE-2026-64164 CVE-2026-64166 CVE-2026-64168 CVE-2026-64178
CVE-2026-64180 CVE-2026-64185 CVE-2026-64188 CVE-2026-64190 CVE-2026-64192
CVE-2026-64214 CVE-2026-64217 CVE-2026-64218 CVE-2026-64219 CVE-2026-64222
CVE-2026-64224 CVE-2026-64225 CVE-2026-64237 CVE-2026-64243 CVE-2026-64244
CVE-2026-64245 CVE-2026-64246 CVE-2026-64247 CVE-2026-64249 CVE-2026-64257
CVE-2026-64266 CVE-2026-64268 CVE-2026-64269 CVE-2026-64271 CVE-2026-64273
CVE-2026-64274 CVE-2026-64275 CVE-2026-64276 CVE-2026-64277 CVE-2026-64286
CVE-2026-64287 CVE-2026-64294 CVE-2026-64296 CVE-2026-64303 CVE-2026-64304
CVE-2026-64305 CVE-2026-64306 CVE-2026-64312 CVE-2026-64313 CVE-2026-64315
CVE-2026-64316 CVE-2026-64317 CVE-2026-64322 CVE-2026-64323 CVE-2026-64329
CVE-2026-64331 CVE-2026-64332 CVE-2026-64333 CVE-2026-64334 CVE-2026-64335
CVE-2026-64337 CVE-2026-64338 CVE-2026-64340 CVE-2026-64341 CVE-2026-64342
CVE-2026-64343 CVE-2026-64344 CVE-2026-64346 CVE-2026-64348 CVE-2026-64350
CVE-2026-64351 CVE-2026-64355 CVE-2026-64358 CVE-2026-64362 CVE-2026-64365
CVE-2026-64375 CVE-2026-64376 CVE-2026-64378 CVE-2026-64381 CVE-2026-64382
CVE-2026-64383 CVE-2026-64384 CVE-2026-64385 CVE-2026-64386 CVE-2026-64387
CVE-2026-64388 CVE-2026-64401 CVE-2026-64403 CVE-2026-64406 CVE-2026-64407
CVE-2026-64408 CVE-2026-64409 CVE-2026-64411 CVE-2026-64412 CVE-2026-64420
CVE-2026-64421 CVE-2026-64423 CVE-2026-64427 CVE-2026-64429 CVE-2026-64433
CVE-2026-64434 CVE-2026-64436 CVE-2026-64440 CVE-2026-64442 CVE-2026-64443
CVE-2026-64444 CVE-2026-64445 CVE-2026-64448 CVE-2026-64450 CVE-2026-64452
CVE-2026-64454 CVE-2026-64455 CVE-2026-64463 CVE-2026-64470 CVE-2026-64471
CVE-2026-64472 CVE-2026-64477 CVE-2026-64478 CVE-2026-64479 CVE-2026-64480
CVE-2026-64481 CVE-2026-64482 CVE-2026-64483 CVE-2026-64484 CVE-2026-64486
CVE-2026-64487 CVE-2026-64489 CVE-2026-64494 CVE-2026-64495 CVE-2026-64496
CVE-2026-64497 CVE-2026-64500 CVE-2026-64503 CVE-2026-64504 CVE-2026-64505
CVE-2026-64511 CVE-2026-64512 CVE-2026-64513 CVE-2026-64515 CVE-2026-64517
CVE-2026-64524 CVE-2026-64527 CVE-2026-64536 CVE-2026-64537 CVE-2026-64538
CVE-2026-64539 CVE-2026-64540 CVE-2026-64541 CVE-2026-64543 CVE-2026-64544
CVE-2026-64545 CVE-2026-64546 CVE-2026-64547 CVE-2026-64548 CVE-2026-64549
CVE-2026-64551 CVE-2026-64552 CVE-2026-64553 CVE-2026-64554 CVE-2026-64558
CVE-2026-64559 CVE-2026-64562 CVE-2026-64563 CVE-2026-64565 CVE-2026-64567
CVE-2026-64568 CVE-2026-64569 CVE-2026-64570 CVE-2026-64571 CVE-2026-64572
CVE-2026-64573 CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64581
CVE-2026-64582 CVE-2026-64583 CVE-2026-64584 CVE-2026-64585 CVE-2026-64593
CVE-2026-64597 CVE-2026-64598 CVE-2026-64599 CVE-2026-64602 CVE-2026-64603
CVE-2026-64604 CVE-2026-6791 CVE-2026-68081 CVE-2026-68082 CVE-2026-68085
CVE-2026-68086 CVE-2026-68088 CVE-2026-68091 CVE-2026-68093 CVE-2026-68102
CVE-2026-68104 CVE-2026-68105 CVE-2026-68106 CVE-2026-68107 CVE-2026-68108
CVE-2026-68110 CVE-2026-68111 CVE-2026-68112 CVE-2026-68113 CVE-2026-68115
CVE-2026-68116 CVE-2026-68117 CVE-2026-68121 CVE-2026-68123 CVE-2026-68124
CVE-2026-68125 CVE-2026-68126 CVE-2026-68127 CVE-2026-68129 CVE-2026-68132
CVE-2026-68133 CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138
CVE-2026-68139 CVE-2026-68142 CVE-2026-68143 CVE-2026-68145 CVE-2026-68149
CVE-2026-68152 CVE-2026-68153 CVE-2026-68154 CVE-2026-68155 CVE-2026-68156
CVE-2026-68157 CVE-2026-68158 CVE-2026-68159 CVE-2026-68160 CVE-2026-68161
CVE-2026-68162 CVE-2026-68166 CVE-2026-68180 CVE-2026-68181 CVE-2026-68182
CVE-2026-68184 CVE-2026-68188 CVE-2026-68189 CVE-2026-68192 CVE-2026-68193
CVE-2026-68194 CVE-2026-68195 CVE-2026-68196 CVE-2026-68197 CVE-2026-68199
CVE-2026-68202 CVE-2026-68204 CVE-2026-68205 CVE-2026-68206 CVE-2026-68207
CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213 CVE-2026-68214
CVE-2026-68215 CVE-2026-68216 CVE-2026-68217 CVE-2026-68218 CVE-2026-68219
CVE-2026-68220 CVE-2026-68222 CVE-2026-68223 CVE-2026-68226 CVE-2026-68227
CVE-2026-68229 CVE-2026-68231 CVE-2026-68234 CVE-2026-68235 CVE-2026-68236
CVE-2026-68238 CVE-2026-68243 CVE-2026-68244 CVE-2026-68245 CVE-2026-68246
CVE-2026-68247 CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251
CVE-2026-68252 CVE-2026-68253 CVE-2026-68254 CVE-2026-68255 CVE-2026-68256
CVE-2026-68257 CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262
CVE-2026-68263 CVE-2026-68267 CVE-2026-68269 CVE-2026-68271 CVE-2026-68272
CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280 CVE-2026-68281
CVE-2026-68284 CVE-2026-68286 CVE-2026-68288 CVE-2026-68289 CVE-2026-68293
CVE-2026-68297 CVE-2026-68299 CVE-2026-68300 CVE-2026-68302 CVE-2026-68303
CVE-2026-68304 CVE-2026-68306 CVE-2026-68308 CVE-2026-68309 CVE-2026-68310
CVE-2026-68312 CVE-2026-68313 CVE-2026-68315 CVE-2026-68320 CVE-2026-68322
CVE-2026-68324 CVE-2026-68325 CVE-2026-68326 CVE-2026-68327 CVE-2026-68328
CVE-2026-68329 CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336
CVE-2026-68339 CVE-2026-68340 CVE-2026-68343 CVE-2026-68346 CVE-2026-68348
CVE-2026-68349 CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353
CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68359 CVE-2026-68360
CVE-2026-68361 CVE-2026-68362 CVE-2026-68363 CVE-2026-68365 CVE-2026-68366
CVE-2026-68368 CVE-2026-68369 CVE-2026-68370 CVE-2026-68372 CVE-2026-68373
CVE-2026-68375 CVE-2026-68377 CVE-2026-68386 CVE-2026-68389 CVE-2026-68391
CVE-2026-68392 CVE-2026-68394 CVE-2026-68397 CVE-2026-68398 CVE-2026-68399
CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406 CVE-2026-68407
CVE-2026-68408 CVE-2026-68410 CVE-2026-68413 CVE-2026-68414 CVE-2026-68417
CVE-2026-68418 CVE-2026-68419 CVE-2026-68422 CVE-2026-68425 CVE-2026-68426
CVE-2026-68427 CVE-2026-68428 CVE-2026-68429 CVE-2026-68430 CVE-2026-68432
CVE-2026-68433 CVE-2026-68434 CVE-2026-68437 CVE-2026-68444 CVE-2026-68445
CVE-2026-68446 CVE-2026-68450 CVE-2026-68470 CVE-2026-68480 CVE-2026-72020
CVE-2026-72032 CVE-2026-72035 CVE-2026-72036 CVE-2026-72046 CVE-2026-72069
CVE-2026-72072 CVE-2026-72083 CVE-2026-72084 CVE-2026-72123 CVE-2026-72132
CVE-2026-72221 CVE-2026-72222 CVE-2026-72251 CVE-2026-72254 CVE-2026-72262
CVE-2026-72288 CVE-2026-72289 CVE-2026-72296 CVE-2026-72307 CVE-2026-72308
CVE-2026-72317 CVE-2026-72341 CVE-2026-72342 CVE-2026-72343 CVE-2026-72389
CVE-2026-72463 CVE-2026-72464 CVE-2026-72466 CVE-2026-72467 CVE-2026-72469
CVE-2026-72473 CVE-2026-72494 CVE-2026-72495 CVE-2026-72496 CVE-2026-72497
CVE-2026-72498 CVE-2026-72499 CVE-2026-72500 CVE-2026-72501 CVE-2026-72502
CVE-2026-74269 CVE-2026-74296 CVE-2026-74297 CVE-2026-74318 CVE-2026-74321
CVE-2026-74334 CVE-2026-74345 CVE-2026-74394 CVE-2026-74395 CVE-2026-74454
CVE-2026-74474 CVE-2026-74481 CVE-2026-74482 CVE-2026-74488 CVE-2026-74495
CVE-2026-74496 CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74516
CVE-2026-74518 CVE-2026-74527 CVE-2026-74537 CVE-2026-74548 CVE-2026-74550
CVE-2026-74556 CVE-2026-74563 CVE-2026-74566 CVE-2026-74567 CVE-2026-74571
CVE-2026-74577 CVE-2026-74581 CVE-2026-74582 CVE-2026-74584 CVE-2026-74610
CVE-2026-74669 CVE-2026-74692 CVE-2026-74694 CVE-2026-74695 CVE-2026-74712
CVE-2026-74717 CVE-2026-74722 CVE-2026-77117 CVE-2026-80489 CVE-2026-80529
CVE-2026-80534 CVE-2026-80590 CVE-2026-80654 CVE-2026-86145 CVE-2026-89156
CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161
-----------------------------------------------------------------
The container bci/bci-sle15-kernel-module-devel was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4254-1
Released: Thu Sep 17 18:03:10 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1230238,1235944,1236344,1240957,1241363,1247180,1247455,1249104,1250748,1251130,1251966,1252682,1253454,1254306,1255225,1255250,1256629,1256708,1257154,1258430,1258472,1258517,1260522,1261562,1261780,1262073,1263004,1263052,1263061,1263133,1263864,1264010,1264012,1264335,1264446,1264541,1264587,1264619,1264643,1264740,1264807,1265068,1265121,1265220,1265449,1265928,1266402,1266860,1266874,1266897,1267023,1267236,1267238,1267501,1267505,1267612,1268276,1268972,1268979,1268987,1269004,1269013,1269108,1269113,1269114,1269126,1269140,1269167,1269234,1269238,1269242,1269256,1269301,1269306,1269313,1269381,1269388,1269402,1269412,1269530,1269579,1269590,1269635,1269647,1269655,1269665,1269686,1269695,1269713,1269731,1269774,1269783,1269792,1269815,1269888,1269965,1269969,1269981,1269985,1270090,1270108,1270111,1270251,1270263,1270268,1271256,1271365,1271366,1271825,1271830,1272150,1272175,1272179,1272182,1272200,1272210,1272213,1272230,1272260,1272261,1272262,1272297,1272346,1
272351,1272359,1272381,1272383,1272385,1272390,1272423,1272429,1272484,1272486,1272497,1272502,1272516,1272569,1272571,1272618,1272641,1272643,1272662,1272673,1272680,1272682,1272756,1272786,1272788,1272798,1272799,1272804,1272868,1272877,1272891,1272893,1272963,1272983,1272993,1273005,1273008,1273019,1273027,1273028,1273030,1273032,1273033,1273036,1273037,1273038,1273053,1273054,1273060,1273105,1273134,1273249,1273250,1273260,1273273,1273274,1273276,1273277,1273280,1273281,1273284,1273285,1273289,1273291,1273294,1273302,1273303,1273305,1273310,1273311,1273316,1273318,1273319,1273323,1273325,1273327,1273334,1273335,1273336,1273337,1273338,1273340,1273341,1273346,1273422,1273426,1273443,1273460,1273463,1273465,1273468,1273469,1273471,1273479,1273480,1273482,1273484,1273488,1273490,1273501,1273503,1273504,1273506,1273523,1273525,1273533,1273536,1273542,1273555,1273578,1273579,1273581,1273582,1273596,1273597,1273598,1273600,1273601,1273602,1273603,1273679,1273681,1273682,1273734,127373
8,1273739,1273741,1273742,1273743,1273745,1273748,1273749,1273755,1273762,1273765,1273766,1273769,1273774,1273778,1273780,1273790,1273796,1273797,1273801,1273804,1273810,1273811,1273812,1273813,1273817,1273822,1273824,1273831,1273832,1273834,1273838,1273844,1273849,1273859,1273860,1273862,1273867,1273868,1273869,1273872,1273876,1273877,1273880,1273882,1273890,1273891,1273892,1273895,1273896,1273903,1273905,1273930,1273933,1273934,1273935,1273936,1273939,1273940,1273941,1273942,1273944,1273945,1273946,1273956,1273957,1273958,1273966,1273967,1273968,1273972,1273974,1273975,1273977,1273982,1273988,1273990,1273991,1273995,1274001,1274003,1274006,1274008,1274009,1274010,1274011,1274012,1274014,1274017,1274019,1274020,1274026,1274028,1274030,1274031,1274035,1274040,1274041,1274055,1274057,1274058,1274061,1274063,1274065,1274067,1274071,1274075,1274076,1274077,1274078,1274208,1274226,1274239,1274243,1274258,1274264,1274265,1274267,1274274,1274277,1274278,1274281,1274283,1274286,1274290,127
4294,1274295,1274296,1274297,1274298,1274314,1274321,1274491,1274497,1274539,1274541,1274543,1274545,1274547,1274550,1274573,1274578,1274580,1274581,1274620,1274622,1274624,1274629,1274632,1274636,1274639,1274640,1274642,1274644,1274645,1274646,1274649,1274650,1274651,1274656,1274659,1274662,1274663,1274665,1274667,1274670,1274675,1274677,1274678,1274679,1274681,1274682,1274690,1274694,1274696,1274698,1274699,1274700,1274702,1274703,1274705,1274706,1274709,1274710,1274713,1274716,1274721,1274725,1274737,1274738,1274749,1274752,1274753,1274754,1274755,1274756,1274764,1274768,1274770,1274783,1274787,1274800,1274801,1274802,1274804,1274805,1274807,1274808,1274811,1274813,1274814,1274831,1274834,1274835,1274847,1274849,1274853,1274868,1274869,1274872,1274873,1274874,1274876,1274877,1274879,1274881,1274883,1274886,1274888,1274891,1274892,1274893,1274894,1274895,1274896,1274897,1274898,1274899,1274901,1274902,1274905,1274906,1274907,1274908,1274913,1274914,1274920,1274921,1274924,1274925,
1274929,1274930,1274933,1274934,1274935,1274941,1274945,1274947,1274951,1274953,1274958,1274968,1274981,1275040,1275069,1275071,1275073,1275076,1275080,1275081,1275083,1275088,1275091,1275125,1275126,1275131,1275132,1275139,1275141,1275146,1275148,1275149,1275150,1275152,1275154,1275155,1275156,1275157,1275158,1275161,1275163,1275164,1275169,1275173,1275176,1275185,1275190,1275192,1275236,1275237,1275239,1275294,1275300,1275301,1275303,1275304,1275305,1275306,1275307,1275470,1275472,1275474,1275479,1275483,1275486,1275487,1275506,1275509,1275511,1275517,1275519,1275528,1275535,1275540,1275553,1275555,1275557,1275561,1275566,1275569,1275572,1275574,1275578,1275582,1275583,1275584,1275591,1275595,1275633,1275636,1275650,1275656,1275659,1275665,1275669,1275687,1275688,1275695,1275696,1275704,1275737,1275782,1275784,1275787,1275788,1275789,1275790,1275797,1275798,1275805,1275817,1275818,1275819,1275820,1275821,1275822,1275823,1275827,1275864,1275867,1275869,1275870,1275871,1275872,12758
86,1275905,1275923,1275925,1275928,1275946,1275950,1275954,1275970,1275973,1275975,1275976,1276029,1276257,1276263,1276270,1276273,1276277,1276335,1276346,1276350,1276355,1276446,1276452,1276500,1276507,1276542,1276546,1276551,1276552,1276561,1276569,1276577,1276665,1276864,1276912,1276913,1276927,1276931,1276937,1276941,1276943,1276944,1276955,1276961,1277022,1277034,1277037,1277047,1277054,1277057,1277059,1277064,1277066,1277069,1277073,1277077,1277095,1277155,1277159,1277160,1277202,1277204,1277275,1277285,1277391,1277408,1277516,1277523,1277551,1277625,1277660,1277678,1277688,1277775,1277776,CVE-2024-44981,CVE-2024-57841,CVE-2025-23137,CVE-2025-38469,CVE-2025-39939,CVE-2025-39964,CVE-2025-40022,CVE-2025-40199,CVE-2025-68179,CVE-2025-68214,CVE-2025-71075,CVE-2025-71104,CVE-2026-23210,CVE-2026-23227,CVE-2026-23230,CVE-2026-23454,CVE-2026-31418,CVE-2026-31531,CVE-2026-31557,CVE-2026-31658,CVE-2026-31663,CVE-2026-43014,CVE-2026-43015,CVE-2026-43116,CVE-2026-43125,CVE-2026-43163,CVE-
2026-43213,CVE-2026-43271,CVE-2026-43273,CVE-2026-43363,CVE-2026-43386,CVE-2026-43416,CVE-2026-43448,CVE-2026-45897,CVE-2026-45968,CVE-2026-46070,CVE-2026-46078,CVE-2026-46091,CVE-2026-46107,CVE-2026-46115,CVE-2026-46127,CVE-2026-46195,CVE-2026-52920,CVE-2026-52925,CVE-2026-52929,CVE-2026-52935,CVE-2026-52939,CVE-2026-52946,CVE-2026-52975,CVE-2026-52977,CVE-2026-52990,CVE-2026-52994,CVE-2026-53001,CVE-2026-53033,CVE-2026-53034,CVE-2026-53059,CVE-2026-53076,CVE-2026-53077,CVE-2026-53089,CVE-2026-53091,CVE-2026-53094,CVE-2026-53096,CVE-2026-53110,CVE-2026-53111,CVE-2026-53126,CVE-2026-53142,CVE-2026-53154,CVE-2026-53163,CVE-2026-53180,CVE-2026-53207,CVE-2026-53219,CVE-2026-53220,CVE-2026-53223,CVE-2026-53228,CVE-2026-53238,CVE-2026-53260,CVE-2026-53263,CVE-2026-53264,CVE-2026-53269,CVE-2026-53273,CVE-2026-53309,CVE-2026-53330,CVE-2026-53336,CVE-2026-53337,CVE-2026-53353,CVE-2026-53365,CVE-2026-53366,CVE-2026-53381,CVE-2026-53388,CVE-2026-63801,CVE-2026-63808,CVE-2026-63810,CVE-2026-63
823,CVE-2026-63827,CVE-2026-63828,CVE-2026-63842,CVE-2026-63850,CVE-2026-63860,CVE-2026-63865,CVE-2026-63868,CVE-2026-63879,CVE-2026-63881,CVE-2026-63886,CVE-2026-63887,CVE-2026-63888,CVE-2026-63889,CVE-2026-63891,CVE-2026-63898,CVE-2026-63920,CVE-2026-63923,CVE-2026-63925,CVE-2026-63926,CVE-2026-63928,CVE-2026-63937,CVE-2026-63944,CVE-2026-63969,CVE-2026-63970,CVE-2026-63972,CVE-2026-63973,CVE-2026-63980,CVE-2026-63985,CVE-2026-63990,CVE-2026-63992,CVE-2026-63995,CVE-2026-63996,CVE-2026-63997,CVE-2026-63998,CVE-2026-63999,CVE-2026-64000,CVE-2026-64001,CVE-2026-64002,CVE-2026-64004,CVE-2026-64005,CVE-2026-64006,CVE-2026-64007,CVE-2026-64010,CVE-2026-64011,CVE-2026-64014,CVE-2026-64015,CVE-2026-64018,CVE-2026-64021,CVE-2026-64029,CVE-2026-64033,CVE-2026-64034,CVE-2026-64039,CVE-2026-64047,CVE-2026-64048,CVE-2026-64051,CVE-2026-64052,CVE-2026-64055,CVE-2026-64056,CVE-2026-64073,CVE-2026-64083,CVE-2026-64084,CVE-2026-64085,CVE-2026-64086,CVE-2026-64087,CVE-2026-64088,CVE-2026-64097,CVE
-2026-64098,CVE-2026-64099,CVE-2026-64102,CVE-2026-64109,CVE-2026-64112,CVE-2026-64113,CVE-2026-64114,CVE-2026-64115,CVE-2026-64118,CVE-2026-64121,CVE-2026-64125,CVE-2026-64126,CVE-2026-64127,CVE-2026-64128,CVE-2026-64131,CVE-2026-64133,CVE-2026-64134,CVE-2026-64135,CVE-2026-64136,CVE-2026-64137,CVE-2026-64144,CVE-2026-64146,CVE-2026-64148,CVE-2026-64155,CVE-2026-64164,CVE-2026-64166,CVE-2026-64168,CVE-2026-64178,CVE-2026-64180,CVE-2026-64185,CVE-2026-64188,CVE-2026-64190,CVE-2026-64192,CVE-2026-64214,CVE-2026-64217,CVE-2026-64218,CVE-2026-64219,CVE-2026-64222,CVE-2026-64224,CVE-2026-64225,CVE-2026-64237,CVE-2026-64243,CVE-2026-64244,CVE-2026-64245,CVE-2026-64246,CVE-2026-64247,CVE-2026-64249,CVE-2026-64257,CVE-2026-64266,CVE-2026-64268,CVE-2026-64269,CVE-2026-64271,CVE-2026-64273,CVE-2026-64274,CVE-2026-64275,CVE-2026-64276,CVE-2026-64277,CVE-2026-64286,CVE-2026-64287,CVE-2026-64294,CVE-2026-64296,CVE-2026-64303,CVE-2026-64304,CVE-2026-64305,CVE-2026-64306,CVE-2026-64312,CVE-2026-6
4313,CVE-2026-64315,CVE-2026-64316,CVE-2026-64317,CVE-2026-64322,CVE-2026-64323,CVE-2026-64329,CVE-2026-64331,CVE-2026-64332,CVE-2026-64333,CVE-2026-64334,CVE-2026-64335,CVE-2026-64337,CVE-2026-64338,CVE-2026-64340,CVE-2026-64341,CVE-2026-64342,CVE-2026-64343,CVE-2026-64344,CVE-2026-64346,CVE-2026-64348,CVE-2026-64350,CVE-2026-64351,CVE-2026-64355,CVE-2026-64358,CVE-2026-64362,CVE-2026-64365,CVE-2026-64375,CVE-2026-64376,CVE-2026-64378,CVE-2026-64381,CVE-2026-64382,CVE-2026-64383,CVE-2026-64384,CVE-2026-64385,CVE-2026-64386,CVE-2026-64387,CVE-2026-64388,CVE-2026-64401,CVE-2026-64403,CVE-2026-64406,CVE-2026-64407,CVE-2026-64408,CVE-2026-64409,CVE-2026-64411,CVE-2026-64412,CVE-2026-64420,CVE-2026-64421,CVE-2026-64423,CVE-2026-64427,CVE-2026-64429,CVE-2026-64433,CVE-2026-64434,CVE-2026-64436,CVE-2026-64440,CVE-2026-64442,CVE-2026-64443,CVE-2026-64444,CVE-2026-64445,CVE-2026-64448,CVE-2026-64450,CVE-2026-64452,CVE-2026-64454,CVE-2026-64455,CVE-2026-64463,CVE-2026-64470,CVE-2026-64471,CV
E-2026-64472,CVE-2026-64477,CVE-2026-64478,CVE-2026-64479,CVE-2026-64480,CVE-2026-64481,CVE-2026-64482,CVE-2026-64483,CVE-2026-64484,CVE-2026-64486,CVE-2026-64487,CVE-2026-64489,CVE-2026-64494,CVE-2026-64495,CVE-2026-64496,CVE-2026-64497,CVE-2026-64500,CVE-2026-64503,CVE-2026-64504,CVE-2026-64505,CVE-2026-64511,CVE-2026-64512,CVE-2026-64513,CVE-2026-64515,CVE-2026-64517,CVE-2026-64524,CVE-2026-64527,CVE-2026-64536,CVE-2026-64537,CVE-2026-64538,CVE-2026-64539,CVE-2026-64540,CVE-2026-64541,CVE-2026-64543,CVE-2026-64544,CVE-2026-64545,CVE-2026-64546,CVE-2026-64547,CVE-2026-64548,CVE-2026-64549,CVE-2026-64551,CVE-2026-64552,CVE-2026-64553,CVE-2026-64554,CVE-2026-64558,CVE-2026-64559,CVE-2026-64562,CVE-2026-64563,CVE-2026-64565,CVE-2026-64567,CVE-2026-64568,CVE-2026-64569,CVE-2026-64570,CVE-2026-64571,CVE-2026-64572,CVE-2026-64573,CVE-2026-64574,CVE-2026-64576,CVE-2026-64577,CVE-2026-64581,CVE-2026-64582,CVE-2026-64583,CVE-2026-64584,CVE-2026-64585,CVE-2026-64593,CVE-2026-64597,CVE-2026-
64598,CVE-2026-64599,CVE-2026-64602,CVE-2026-64603,CVE-2026-64604,CVE-2026-68081,CVE-2026-68082,CVE-2026-68085,CVE-2026-68086,CVE-2026-68088,CVE-2026-68091,CVE-2026-68093,CVE-2026-68102,CVE-2026-68104,CVE-2026-68105,CVE-2026-68106,CVE-2026-68107,CVE-2026-68108,CVE-2026-68110,CVE-2026-68111,CVE-2026-68112,CVE-2026-68113,CVE-2026-68115,CVE-2026-68116,CVE-2026-68117,CVE-2026-68121,CVE-2026-68123,CVE-2026-68124,CVE-2026-68125,CVE-2026-68126,CVE-2026-68127,CVE-2026-68129,CVE-2026-68132,CVE-2026-68133,CVE-2026-68135,CVE-2026-68136,CVE-2026-68137,CVE-2026-68138,CVE-2026-68139,CVE-2026-68142,CVE-2026-68143,CVE-2026-68145,CVE-2026-68149,CVE-2026-68152,CVE-2026-68153,CVE-2026-68154,CVE-2026-68155,CVE-2026-68156,CVE-2026-68157,CVE-2026-68158,CVE-2026-68159,CVE-2026-68160,CVE-2026-68161,CVE-2026-68162,CVE-2026-68166,CVE-2026-68180,CVE-2026-68181,CVE-2026-68182,CVE-2026-68184,CVE-2026-68188,CVE-2026-68189,CVE-2026-68192,CVE-2026-68193,CVE-2026-68194,CVE-2026-68195,CVE-2026-68196,CVE-2026-68197,C
VE-2026-68199,CVE-2026-68202,CVE-2026-68204,CVE-2026-68205,CVE-2026-68206,CVE-2026-68207,CVE-2026-68209,CVE-2026-68210,CVE-2026-68212,CVE-2026-68213,CVE-2026-68214,CVE-2026-68215,CVE-2026-68216,CVE-2026-68217,CVE-2026-68218,CVE-2026-68219,CVE-2026-68220,CVE-2026-68222,CVE-2026-68223,CVE-2026-68226,CVE-2026-68227,CVE-2026-68229,CVE-2026-68231,CVE-2026-68234,CVE-2026-68235,CVE-2026-68236,CVE-2026-68238,CVE-2026-68243,CVE-2026-68244,CVE-2026-68245,CVE-2026-68246,CVE-2026-68247,CVE-2026-68248,CVE-2026-68249,CVE-2026-68250,CVE-2026-68251,CVE-2026-68252,CVE-2026-68253,CVE-2026-68254,CVE-2026-68255,CVE-2026-68256,CVE-2026-68257,CVE-2026-68259,CVE-2026-68260,CVE-2026-68261,CVE-2026-68262,CVE-2026-68263,CVE-2026-68267,CVE-2026-68269,CVE-2026-68271,CVE-2026-68272,CVE-2026-68277,CVE-2026-68278,CVE-2026-68279,CVE-2026-68280,CVE-2026-68281,CVE-2026-68284,CVE-2026-68286,CVE-2026-68288,CVE-2026-68289,CVE-2026-68293,CVE-2026-68297,CVE-2026-68299,CVE-2026-68300,CVE-2026-68302,CVE-2026-68303,CVE-2026
-68304,CVE-2026-68306,CVE-2026-68308,CVE-2026-68309,CVE-2026-68310,CVE-2026-68312,CVE-2026-68313,CVE-2026-68315,CVE-2026-68320,CVE-2026-68322,CVE-2026-68324,CVE-2026-68325,CVE-2026-68326,CVE-2026-68327,CVE-2026-68328,CVE-2026-68329,CVE-2026-68331,CVE-2026-68333,CVE-2026-68335,CVE-2026-68336,CVE-2026-68339,CVE-2026-68340,CVE-2026-68343,CVE-2026-68346,CVE-2026-68348,CVE-2026-68349,CVE-2026-68350,CVE-2026-68351,CVE-2026-68352,CVE-2026-68353,CVE-2026-68354,CVE-2026-68355,CVE-2026-68357,CVE-2026-68359,CVE-2026-68360,CVE-2026-68361,CVE-2026-68362,CVE-2026-68363,CVE-2026-68365,CVE-2026-68366,CVE-2026-68368,CVE-2026-68369,CVE-2026-68370,CVE-2026-68372,CVE-2026-68373,CVE-2026-68375,CVE-2026-68377,CVE-2026-68386,CVE-2026-68389,CVE-2026-68391,CVE-2026-68392,CVE-2026-68394,CVE-2026-68397,CVE-2026-68398,CVE-2026-68399,CVE-2026-68402,CVE-2026-68403,CVE-2026-68405,CVE-2026-68406,CVE-2026-68407,CVE-2026-68408,CVE-2026-68410,CVE-2026-68413,CVE-2026-68414,CVE-2026-68417,CVE-2026-68418,CVE-2026-68419,
CVE-2026-68422,CVE-2026-68425,CVE-2026-68426,CVE-2026-68427,CVE-2026-68428,CVE-2026-68429,CVE-2026-68430,CVE-2026-68432,CVE-2026-68433,CVE-2026-68434,CVE-2026-68437,CVE-2026-68444,CVE-2026-68445,CVE-2026-68446,CVE-2026-68450,CVE-2026-68470,CVE-2026-68480,CVE-2026-72020,CVE-2026-72032,CVE-2026-72035,CVE-2026-72036,CVE-2026-72046,CVE-2026-72069,CVE-2026-72072,CVE-2026-72083,CVE-2026-72084,CVE-2026-72123,CVE-2026-72132,CVE-2026-72221,CVE-2026-72222,CVE-2026-72251,CVE-2026-72254,CVE-2026-72262,CVE-2026-72288,CVE-2026-72289,CVE-2026-72296,CVE-2026-72307,CVE-2026-72308,CVE-2026-72317,CVE-2026-72341,CVE-2026-72342,CVE-2026-72343,CVE-2026-72389,CVE-2026-72463,CVE-2026-72464,CVE-2026-72466,CVE-2026-72467,CVE-2026-72469,CVE-2026-72473,CVE-2026-72494,CVE-2026-72495,CVE-2026-72496,CVE-2026-72497,CVE-2026-72498,CVE-2026-72499,CVE-2026-72500,CVE-2026-72501,CVE-2026-72502,CVE-2026-74269,CVE-2026-74296,CVE-2026-74297,CVE-2026-74318,CVE-2026-74321,CVE-2026-74334,CVE-2026-74345,CVE-2026-74394,CVE-202
6-74395,CVE-2026-74454,CVE-2026-74474,CVE-2026-74481,CVE-2026-74482,CVE-2026-74488,CVE-2026-74495,CVE-2026-74496,CVE-2026-74509,CVE-2026-74510,CVE-2026-74512,CVE-2026-74516,CVE-2026-74518,CVE-2026-74527,CVE-2026-74537,CVE-2026-74548,CVE-2026-74550,CVE-2026-74556,CVE-2026-74563,CVE-2026-74566,CVE-2026-74567,CVE-2026-74571,CVE-2026-74577,CVE-2026-74581,CVE-2026-74582,CVE-2026-74584,CVE-2026-74610,CVE-2026-74669,CVE-2026-74692,CVE-2026-74694,CVE-2026-74695,CVE-2026-74712,CVE-2026-74717,CVE-2026-74722,CVE-2026-80529,CVE-2026-80534,CVE-2026-80590,CVE-2026-80654
The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
- CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
- CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).
- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).
- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).
- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).
- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).
- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).
- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).
- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).
- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).
- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).
- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).
- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).
- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).
- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).
- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).
- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).
- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).
- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).
- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).
- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).
- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).
- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).
- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).
- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).
- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).
- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).
- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).
- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).
- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).
- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).
- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).
- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).
- CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).
- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).
- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).
- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).
- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).
- CVE-2026-64055,CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).
- CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).
- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).
- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).
- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).
- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).
- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).
- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).
- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).
- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).
- CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).
- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).
- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).
- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).
- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).
- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).
- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).
- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).
- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).
- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
(bsc#1272799).
- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
- CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788).
- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).
- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).
- CVE-2026-64244: drivers/base/memory: set mem->altmap after successful device registration (bsc#1273812).
- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).
- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).
- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).
- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).
- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).
- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).
- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).
- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).
- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).
- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).
- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).
- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).
- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).
- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).
- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).
- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).
- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).
- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).
- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).
- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).
- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).
- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
- CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).
- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).
- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).
- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).
- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).
- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).
- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).
- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).
- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).
- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
- CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).
- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).
- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).
- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).
- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).
- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).
- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).
- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).
- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).
- CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881).
- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).
- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).
- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).
- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).
- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).
- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).
- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).
- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).
- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).
- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).
- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).
- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).
- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).
- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).
- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
- CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305).
- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).
- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).
- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).
- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).
- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).
- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).
- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).
- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).
- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).
- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).
- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).
- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).
- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).
- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).
- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).
- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).
- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).
- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).
- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).
- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).
- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).
- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).
- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).
- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).
- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).
- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).
- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).
- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).
- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).
- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).
- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).
- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).
- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).
- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).
- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).
- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).
- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).
- CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).
- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).
- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).
- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).
- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).
- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).
- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).
- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).
- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).
- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).
- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).
- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).
- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).
- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).
- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).
- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).
- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
- CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660).
- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).
- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).
- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).
- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).
- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).
- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).
- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).
- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).
- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).
- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).
- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).
- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).
- CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).
- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).
- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).
- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).
- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).
- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).
- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).
- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).
- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).
- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).
- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095).
- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).
- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).
- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).
- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).
- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).
- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).
- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).
- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).
- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).
- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).
- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).
- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).
- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).
- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).
- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).
- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).
- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).
- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).
- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).
- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).
- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).
- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).
- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).
- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).
- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).
- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).
- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).
The following non security issues were fixed:
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).
- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).
- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).
- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).
- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).
- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).
- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).
- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).
- ACPI: video: Release PCI device reference after lookup (git-fixes).
- add my missing Reviewed-by: tag.
- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).
- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).
- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).
- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).
- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).
- ALSA: dummy: Check card index validity at probe (stable-fixes).
- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).
- ALSA: hda: Fix connection list comparison in proc output (git-fixes).
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).
- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).
- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).
- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).
- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).
- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).
- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).
- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).
- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).
- apparmor: advertise the tcp fast open fix is applied (git-fixes).
- arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).
- ASoC: adau1761: sort the register default table (git-fixes).
- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).
- ASoC: apple: mca: increase SERDES reset delay (git-fixes).
- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).
- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l41: sort the register default table (git-fixes).
- ASoC: cs35l45: sort the register default table (git-fixes).
- ASoC: cs4265: sort the register default table (git-fixes).
- ASoC: cx2072x: sort the register default table (git-fixes).
- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).
- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).
- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).
- ASoC: fsl_easrc: sort the register default table (git-fixes).
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).
- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).
- ASoC: max9860: sort the register default table (git-fixes).
- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).
- ASoC: ml26124: sort the register default table (git-fixes).
- ASoC: pcm512x: sort the register default table (git-fixes).
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).
- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).
- ASoC: rt274: sort the register default table (git-fixes).
- ASoC: rt286: sort the register default table (git-fixes).
- ASoC: rt298: sort the register default table (git-fixes).
- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).
- ASoC: rt700: drop duplicate reg_default entry (git-fixes).
- ASoC: rt700: sort the register default table (git-fixes).
- ASoC: rt711-sdca: sort the register default tables (git-fixes).
- ASoC: rt711: sort the register default table (git-fixes).
- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).
- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).
- ASoC: rt715-sdca: sort the register default tables (git-fixes).
- ASoC: rt715: sort the register default table (git-fixes).
- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt1316-sdw: sort the register default table (git-fixes).
- ASoC: rt1318-sdw: sort the register default table (git-fixes).
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).
- ASoC: sgtl5000: sort the register default table (git-fixes).
- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).
- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).
- ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).
- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).
- ASoC: SOF: validate topology volume range before allocation (git-fixes).
- ASoC: sti-sas: sort the register default table (git-fixes).
- ASoC: tas2552: sort the register default table (git-fixes).
- ASoC: tas2764: sort the register default table (git-fixes).
- ASoC: tas2780: sort the register default table (git-fixes).
- ASoC: tegra210_i2s: sort the register default table (git-fixes).
- ASoC: tegra210_mixer: sort the register default table (git-fixes).
- ASoC: tegra: Fix the MIXER enable default value (git-fixes).
- ASoC: tegra: Sort MBDRC register defaults (git-fixes).
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).
- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).
- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).
- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).
- batman-adv: fix stale receive device on merged fragments (git-fixes).
- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).
- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).
- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).
- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).
- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).
- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).
- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).
- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).
- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).
- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).
- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).
- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).
- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).
- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).
- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).
- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).
- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).
- bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).
- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).
- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).
- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).
- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).
- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).
- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).
- bnxt_en: Set bp->max_tpa according to what the FW supports (jsc#PED-16798).
- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).
- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).
- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).
- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).
- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).
- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).
- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).
- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).
- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).
- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).
- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).
- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).
- crypto: doc - Remove extra parenthesis (git-fixes).
- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).
- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).
- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).
- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).
- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).
- crypto: qat - clear AES key schedule from stack (git-fixes).
- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).
- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).
- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).
- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).
- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).
- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).
- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).
- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).
- dmaengine: dw-edma: Serialize abort state updates (git-fixes).
- dmaengine: dw-edma: Serialize channel state checks (git-fixes).
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).
- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).
- driver core: soc: Unregister bus on early device registration failure (git-fixes).
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).
- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).
- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).
- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).
- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).
- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).
- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).
- drm/amd/pm: Use same metric table for APU (stable-fixes).
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).
- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).
- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).
- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).
- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).
- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).
- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).
- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).
- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).
- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).
- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).
- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).
- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).
- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).
- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).
- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).
- drm/amdgpu: remove unused function parameter (stable-fixes).
- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).
- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).
- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).
- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).
- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).
- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).
- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).
- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).
- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).
- drm/hibmc: Fix list of formats on the primary plane (git-fixes).
- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).
- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).
- drm/i915/hdcp: check streams bounds before overflow (git-fixes).
- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).
- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).
- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).
- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).
- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).
- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).
- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).
- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).
- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).
- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).
- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).
- drm/panthor: fix firmware control interface bounds checks (git-fixes).
- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).
- drm/panthor: skip zero-sized firmware sections (git-fixes).
- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).
- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).
- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).
- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).
- drm/sun4i: Drop node references while building component list (git-fixes).
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).
- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).
- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).
- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).
- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).
- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).
- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).
- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).
- drm/tve200: add OF module alias for autoloading (git-fixes).
- drm/xe/oa: Check managed mutex initialization errors (git-fixes).
- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).
- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).
- drm/xe: Order ring writes before ring tail updates (git-fixes).
- drm/xe: Stub out new pagefault layer (stable-fixes).
- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).
- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).
- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).
- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).
- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).
- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).
- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).
- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).
- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).
- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).
- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).
- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).
- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).
- firmware: arm_scmi: Fix requested device removal race (git-fixes).
- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).
- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).
- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).
- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).
- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).
- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).
- fpga: dfl: fme: add error handling (git-fixes).
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).
- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).
- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).
- HID: core: fix number/pointer type confusion on long items (git-fixes).
- HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes).
- HID: hyperv: validate initial device info bounds (git-fixes).
- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).
- HID: lg4ff: validate report length before fixed offsets (git-fixes).
- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).
- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).
- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).
- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).
- HID: roccat: bound device-supplied profile index (git-fixes).
- HID: roccat: free buffered reports when destroying device (git-fixes).
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).
- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).
- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).
- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).
- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).
- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).
- hwmon: (max6621) fix temperature clamp range (git-fixes).
- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).
- hwrng: omap - Fix probe error path cleanup (git-fixes).
- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).
- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).
- i2c: core: fix debugfs UAF on adapter removal (git-fixes).
- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).
- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).
- i2c: ocores: Disable clock on failed resume (git-fixes).
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).
- i3c: master: Fix device_register() error path (git-fixes).
- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).
- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).
- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).
- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).
- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).
- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).
- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).
- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).
- iio: light: cm32181: return zero after writing calibscale (git-fixes).
- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).
- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).
- iio: light: isl29028: return zero in write_raw() on success (git-fixes).
- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).
- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).
- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).
- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).
- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).
- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).
- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).
- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).
- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).
- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).
- Input: iforce - validate input packet lengths (stable-fixes).
- Input: iqs5xx - validate firmware record destination span (git-fixes).
- Input: mms114 - fix Y-resolution configuration (git-fixes).
- Input: psxpad-spi - set driver data before use (git-fixes).
- Input: sur40 - fix input device registration ordering (stable-fixes).
- Input: sur40 - fix V4L error path cleanup (stable-fixes).
- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).
- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).
- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).
- ipmi: ipmb: validate write message length (git-fixes).
- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).
- kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).
- kthread: Make sure kthread hasn't started while binding it (bsc#1269313).
- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).
- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).
- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).
- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).
- lib/string: fix memchr_inv() for large ranges (git-fixes).
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).
- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).
- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).
- maple_tree: fix argument name in header (git-fixes).
- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).
- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).
- media: cec-pin: Fix event FIFO ordering (git-fixes).
- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).
- media: cec: Serialize exclusive follower delivery (git-fixes).
- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).
- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).
- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).
- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).
- media: cx23885: cancel NetUP CI work before teardown (git-fixes).
- media: em28xx: defer audio-only extension registration (git-fixes).
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes).
- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).
- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).
- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).
- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).
- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).
- media: imx219: Fix maximum frame length in lines (git-fixes).
- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).
- media: mc-entity: Add missing kerneldoc (git-fixes).
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).
- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).
- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).
- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).
- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).
- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).
- media: s2255: check firmware size before reading trailing marker (git-fixes).
- media: saa7164: fix cleanup on resource allocation failure (git-fixes).
- media: tda18250: fix possible integer overflow (git-fixes).
- media: usbtv: keep device alive while ALSA card exists (git-fixes).
- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).
- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).
- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).
- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).
- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).
- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).
- media: zoran: Avoid freeing a registered video_device twice (git-fixes).
- mei: pull kvfree out of spinlock (git-fixes).
- mfd: iqs62x: Reject zero-length firmware records (git-fixes).
- mfd: rave-sp: validate received frame payload lengths (git-fixes).
- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).
- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).
- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes).
- misc: rtsx: add missing write register handling (git-fixes).
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).
- mkspec-dtb: Move DTS prefix into package list.
- mkspec-dtb: Move provides-obsoletes to package list.
- mkspec-dtb: Put per-architecture package lists into a hash.
- mkspec-dtb: re-indent.
- mm: Create/affine kcompactd to its preferred node (bsc#1269313).
- mm: Create/affine kswapd to its preferred node (bsc#1269313).
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).
- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).
- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).
- mtd: afs: validate v2 image info bounds (git-fixes).
- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).
- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).
- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).
- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
- net: mana: Add handler for sriov configure (bsc#1272756).
- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).
- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).
- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).
- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).
- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).
- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).
- nfc: digital: Do not dump a NULL response in command completion (git-fixes).
- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).
- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).
- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes).
- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).
- nfc: microread: validate target discovery payload lengths (git-fixes).
- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).
- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).
- nfc: nci: free destination parameters when closing a connection (git-fixes).
- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).
- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).
- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).
- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).
- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).
- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).
- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).
- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).
- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).
- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).
- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).
- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).
- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).
- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).
- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).
- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).
- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).
- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).
- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).
- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).
- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).
- platform/x86: dell-privacy: Fix race condition (git-fixes).
- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).
- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).
- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).
- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).
- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).
- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).
- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).
- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).
- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).
- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).
- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).
- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).
- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).
- platform/x86: ISST: Return error during profile addition (git-fixes).
- platform/x86: ISST: Use PP level enable mask (git-fixes).
- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).
- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).
- platform/x86: ISST: Validate parameter for core power state (git-fixes).
- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).
- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).
- power: supply: bd99954: Drop bad register fields (git-fixes).
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).
- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).
- power: supply: bq24257: fix use-after-free on remove (git-fixes).
- power: supply: bq25890: Fix power_supply reference leak (git-fixes).
- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).
- power: supply: isp1704_charger: cancel work on remove (git-fixes).
- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).
- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).
- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).
- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).
- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).
- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).
- power: supply: twl4030_charger: cancel workers via devm (git-fixes).
- power: supply: ucs1002: fix use-after-free on remove (git-fixes).
- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).
- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).
- powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256).
- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752
ltc#221290).
- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).
- ppdev: prevent overflow when setting port timeout (git-fixes).
- qede: fix out-of-bounds check for cqe->len_list (git-fixes).
- rapidio: clear mport->net when rio_add_net() fails (git-fixes).
- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).
- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).
- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
- RDMA/mana_ib: unify QP lookup table (git-fixes).
- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).
- regulator: core: use system_freezable_wq for init complete work (git-fixes).
- regulator: devres: add API for reference voltage supplies (stable-fixes).
- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes).
- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).
- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).
- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).
- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).
- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).
- rpmsg: core: Fix incorrect return value documentation (git-fixes).
- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).
- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).
- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).
- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).
- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).
- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).
- rtc: zynqmp: Return optional clock lookup errors (git-fixes).
- sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).
- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).
- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).
- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).
- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).
- scsi: fnic: Bump up version number (bsc#1236344).
- scsi: fnic: Decode firmware role configuration (bsc#1236344).
- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).
- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).
- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).
- scsi: fnic: Make debug logging protocol independent (bsc#1236344).
- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).
- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).
- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).
- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).
- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).
- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).
- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).
- scsi: fnic: Switch to use %ptSp (bsc#1236344).
- scsi: fnic: Track NVMe transport statistics (bsc#1236344).
- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).
- scsi: fnic: Use mempool for receive frames (bsc#1236344).
- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).
- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).
- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).
- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).
- serial: amba-pl011: unprepare console clock on unregister (git-fixes).
- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).
- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).
- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).
- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).
- smb: client: resolve SWN tcon from live registrations (bsc#1273872).
- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).
- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).
- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).
- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).
- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).
- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).
- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).
- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).
- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).
- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).
- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).
- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).
- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).
- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).
- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).
- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes).
- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).
- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).
- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).
- tpm: st33zp24: Return zero on status read failure (git-fixes).
- tpm: st33zp24: Validate locality read result (git-fixes).
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).
- tty: clear cdev pointer after cdev_add() failure (git-fixes).
- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).
- tty: skip cdev_del() when no cdev is registered (git-fixes).
- uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).
- uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).
- uio: Fix stale info pointer in failed registration path (git-fixes).
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).
- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).
- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).
- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).
- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).
- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).
- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).
- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).
- usb: gadget: uac: validate rate list length before storing (git-fixes).
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).
- usb: mtu3: allow system suspend during active gadget connection (git-fixes).
- usb: musb: omap2430: clean up probe error handling (stable-fixes).
- USB: phy: fsl-usb: fix missing static keywords (git-fixes).
- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).
- USB: serial: digi_acceleport: fix port registration order (git-fixes).
- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).
- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).
- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).
- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).
- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).
- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).
- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).
- vt: add permission check for KDSKBMETA ioctl (stable-fixes).
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).
- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).
- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).
- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).
- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).
- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).
- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).
- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).
- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).
- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).
- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).
- wifi: mac80211: fix multi-link element inheritance (git-fixes).
- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).
- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).
- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).
- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).
- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).
- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).
- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).
- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).
- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).
- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).
- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).
- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).
- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).
- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).
- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).
- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).
- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).
- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).
- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).
- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).
- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).
- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).
- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).
- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).
- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).
- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).
- wifi: rtw89: fix HE extended capability length check (git-fixes).
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).
- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).
- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4263-1
Released: Fri Sep 18 13:40:22 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1257055,1262432
This update for suse-module-tools fixes the following issues:
- Update to version 15.7.11:
* weak-modules2: don't remove symlinks in the rpm --reinstall case (bsc#1257055, bsc#1262432)
The following package changes have been done:
- glibc-2.38-150600.14.58.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- glibc-locale-base-2.38-150600.14.58.1 updated
- kernel-macros-6.4.0-150700.53.81.1 updated
- glibc-locale-2.38-150600.14.58.1 updated
- kernel-devel-6.4.0-150700.53.81.1 updated
- suse-module-tools-15.7.11-150700.3.14.1 updated
- glibc-devel-2.38-150600.14.58.1 updated
- kernel-default-devel-6.4.0-150700.53.81.1 updated
- kernel-syms-6.4.0-150700.53.81.1 updated
- container:registry.suse.com-bci-bci-base-15.7-a487b809bb79c405a61bade69958738f14ef31118f5db914afa582498de5ba00-0 updated
More information about the sle-container-updates
mailing list