SUSE-IU-2026:7300-1: Security update of suse/sl-micro/6.2/kvm-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Sep 23 08:21:39 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.2/kvm-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7300-1
Image Tags : suse/sl-micro/6.2/kvm-os-container:2.3.1 , suse/sl-micro/6.2/kvm-os-container:2.3.1-8.136 , suse/sl-micro/6.2/kvm-os-container:latest
Image Release : 8.136
Severity : important
Type : security
References : 1236344 1240890 1240957 1249104 1255225 1255531 1256629 1256671
1258278 1260501 1260577 1261606 1262073 1262756 1263004 1263864
1263865 1264267 1264335 1264444 1264541 1264587 1264619 1264807
1264851 1265036 1265068 1265121 1265132 1265141 1265220 1266710
1266860 1266874 1266897 1266928 1267023 1267238 1267373 1267501
1267586 1267612 1267882 1267985 1268886 1268972 1268979 1269000
1269004 1269010 1269013 1269108 1269113 1269114 1269126 1269134
1269140 1269162 1269167 1269238 1269242 1269256 1269301 1269306
1269380 1269381 1269388 1269402 1269412 1269417 1269528 1269530
1269579 1269583 1269590 1269633 1269635 1269655 1269665 1269685
1269686 1269695 1269697 1269774 1269783 1269792 1269815 1269816
1269888 1269965 1269969 1269985 1269999 1270090 1270108 1270111
1270139 1270219 1270251 1270266 1270267 1271050 1271256 1271365
1271825 1272148 1272149 1272175 1272182 1272199 1272200 1272210
1272213 1272230 1272260 1272261 1272262 1272284 1272287 1272297
1272346 1272366 1272385 1272390 1272423 1272426 1272429 1272484
1272486 1272497 1272501 1272502 1272513 1272516 1272568 1272569
1272584 1272641 1272643 1272673 1272756 1272786 1272788 1272791
1272798 1272799 1272804 1272855 1272865 1272868 1272869 1272877
1272891 1272893 1272894 1272904 1272905 1272918 1272963 1272969
1272971 1272983 1272985 1273008 1273019 1273027 1273030 1273032
1273033 1273036 1273037 1273038 1273060 1273105 1273107 1273119
1273134 1273231 1273249 1273251 1273260 1273271 1273273 1273274
1273276 1273277 1273280 1273281 1273283 1273284 1273285 1273286
1273288 1273289 1273291 1273294 1273302 1273303 1273305 1273309
1273310 1273311 1273312 1273314 1273316 1273317 1273318 1273319
1273323 1273325 1273327 1273331 1273334 1273335 1273336 1273337
1273338 1273339 1273340 1273341 1273346 1273420 1273422 1273426
1273443 1273460 1273461 1273463 1273465 1273468 1273469 1273471
1273479 1273480 1273482 1273484 1273486 1273488 1273490 1273495
1273501 1273503 1273504 1273506 1273507 1273509 1273511 1273520
1273523 1273524 1273525 1273533 1273536 1273538 1273542 1273550
1273555 1273557 1273567 1273578 1273579 1273581 1273582 1273596
1273597 1273598 1273600 1273601 1273602 1273603 1273679 1273681
1273682 1273734 1273737 1273738 1273739 1273740 1273741 1273742
1273743 1273744 1273745 1273746 1273748 1273749 1273755 1273759
1273762 1273765 1273766 1273769 1273770 1273774 1273776 1273778
1273780 1273782 1273788 1273790 1273796 1273797 1273801 1273803
1273804 1273809 1273810 1273811 1273812 1273813 1273817 1273822
1273824 1273831 1273834 1273838 1273839 1273842 1273844 1273848
1273849 1273852 1273855 1273859 1273860 1273862 1273864 1273866
1273867 1273868 1273869 1273870 1273872 1273876 1273877 1273880
1273882 1273890 1273891 1273892 1273895 1273896 1273898 1273899
1273903 1273904 1273905 1273930 1273933 1273934 1273935 1273936
1273939 1273940 1273941 1273942 1273944 1273945 1273946 1273947
1273949 1273953 1273954 1273956 1273957 1273958 1273959 1273963
1273966 1273967 1273968 1273972 1273974 1273975 1273977 1273988
1273990 1273991 1273995 1273997 1273999 1274001 1274003 1274006
1274008 1274009 1274010 1274011 1274012 1274014 1274017 1274019
1274020 1274026 1274028 1274030 1274031 1274035 1274036 1274040
1274041 1274052 1274055 1274057 1274058 1274060 1274063 1274065
1274067 1274071 1274075 1274076 1274077 1274078 1274208 1274226
1274239 1274243 1274252 1274253 1274258 1274264 1274265 1274267
1274274 1274277 1274278 1274281 1274283 1274286 1274290 1274292
1274294 1274295 1274296 1274314 1274321 1274491 1274492 1274494
1274497 1274539 1274541 1274543 1274545 1274547 1274550 1274556
1274573 1274578 1274580 1274581 1274622 1274624 1274628 1274632
1274636 1274637 1274639 1274640 1274642 1274644 1274645 1274646
1274650 1274651 1274652 1274656 1274657 1274659 1274662 1274665
1274667 1274669 1274670 1274671 1274675 1274677 1274678 1274679
1274681 1274682 1274690 1274694 1274696 1274698 1274699 1274700
1274702 1274703 1274705 1274706 1274707 1274709 1274710 1274713
1274716 1274721 1274725 1274727 1274730 1274737 1274738 1274749
1274750 1274751 1274752 1274753 1274754 1274755 1274756 1274764
1274768 1274770 1274771 1274773 1274782 1274783 1274787 1274800
1274801 1274802 1274803 1274804 1274805 1274807 1274808 1274811
1274813 1274814 1274831 1274834 1274835 1274838 1274847 1274849
1274853 1274868 1274869 1274872 1274873 1274874 1274876 1274877
1274879 1274881 1274883 1274886 1274887 1274888 1274891 1274892
1274893 1274894 1274895 1274896 1274897 1274898 1274899 1274900
1274901 1274902 1274904 1274905 1274906 1274907 1274908 1274913
1274914 1274921 1274924 1274925 1274927 1274929 1274930 1274933
1274934 1274935 1274938 1274939 1274940 1274941 1274945 1274947
1274951 1274952 1274953 1274955 1274957 1274958 1274965 1274968
1274978 1274981 1275040 1275045 1275069 1275071 1275072 1275073
1275076 1275080 1275081 1275083 1275088 1275091 1275092 1275094
1275125 1275126 1275129 1275131 1275132 1275139 1275141 1275146
1275148 1275149 1275150 1275152 1275154 1275155 1275156 1275157
1275158 1275160 1275161 1275163 1275164 1275169 1275173 1275176
1275185 1275190 1275192 1275229 1275236 1275237 1275238 1275239
1275294 1275300 1275301 1275303 1275304 1275305 1275306 1275307
1275441 1275470 1275474 1275479 1275481 1275483 1275486 1275487
1275496 1275506 1275509 1275511 1275514 1275517 1275519 1275528
1275535 1275540 1275553 1275555 1275557 1275561 1275566 1275569
1275572 1275574 1275578 1275582 1275583 1275584 1275587 1275588
1275591 1275595 1275596 1275633 1275636 1275650 1275655 1275656
1275659 1275665 1275669 1275672 1275679 1275685 1275687 1275688
1275690 1275695 1275696 1275704 1275737 1275782 1275784 1275787
1275788 1275789 1275790 1275798 1275799 1275801 1275802 1275804
1275805 1275812 1275817 1275818 1275819 1275820 1275821 1275822
1275823 1275827 1275864 1275866 1275867 1275869 1275870 1275871
1275872 1275886 1275905 1275923 1275925 1275928 1275950 1275954
1275956 1275970 1275973 1275975 1275976 1275985 1276006 1276029
1276257 1276258 1276263 1276265 1276267 1276270 1276273 1276277
1276333 1276335 1276339 1276341 1276346 1276354 1276355 1276381
1276395 1276446 1276452 1276468 1276471 1276473 1276500 1276507
1276512 1276528 1276542 1276546 1276547 1276551 1276552 1276553
1276561 1276562 1276566 1276569 1276572 1276577 1276586 1276665
1276766 1276767 1276771 1276785 1276793 1276801 1276803 1276814
1276818 1276821 1276831 1276840 1276864 1276865 1276866 1276870
1276876 1276880 1276905 1276913 1276922 1276931 1276937 1276941
1276955 1276957 1276961 1277022 1277023 1277033 1277034 1277037
1277047 1277054 1277057 1277059 1277062 1277066 1277069 1277070
1277077 1277078 1277092 1277095 1277108 1277114 1277115 1277118
1277120 1277155 1277159 1277160 1277202 1277204 1277227 1277229
1277230 1277231 1277233 1277249 1277254 1277265 1277268 1277275
1277285 1277308 1277311 1277315 1277321 1277328 1277335 1277349
1277350 1277391 1277407 1277408 1277485 1277505 1277513 1277551
1277553 1277561 1277574 1277636 1277641 1277649 1277655 1277656
1277660 1277668 1277680 1277688 1277726 1277728 1277738 1277748
1277761 1277764 1277773 1277775 1277776 1277782 1277783 1277813
1277818 1277822 1277845 1277862 1277874 1277876 1277898 1277901
1277908 1277918 1278039 1278070 1278088 1278094 1278098 1278113
1278155 1278180 1278233 1278236 1278240 1278253 1278293 1278324
1278331 1278334 1278347 1278348 1278349 1278395 1278416 1278703
1278716 1278733 1279487 1279537 1279580 1279813 1279842 1279847
1279887 1280139 CVE-2025-68214 CVE-2025-68358 CVE-2025-68780
CVE-2025-71075 CVE-2026-13595 CVE-2026-23113 CVE-2026-23306 CVE-2026-23348
CVE-2026-27456 CVE-2026-31418 CVE-2026-31530 CVE-2026-31531 CVE-2026-43116
CVE-2026-43125 CVE-2026-43163 CVE-2026-43239 CVE-2026-43271 CVE-2026-43299
CVE-2026-43331 CVE-2026-43355 CVE-2026-43363 CVE-2026-43416 CVE-2026-43439
CVE-2026-43448 CVE-2026-45860 CVE-2026-45897 CVE-2026-45968 CVE-2026-46007
CVE-2026-46070 CVE-2026-46091 CVE-2026-46107 CVE-2026-46115 CVE-2026-46133
CVE-2026-46135 CVE-2026-46195 CVE-2026-46304 CVE-2026-52912 CVE-2026-52920
CVE-2026-52928 CVE-2026-52929 CVE-2026-52935 CVE-2026-52939 CVE-2026-52946
CVE-2026-52977 CVE-2026-52990 CVE-2026-52991 CVE-2026-52994 CVE-2026-53001
CVE-2026-53031 CVE-2026-53033 CVE-2026-53034 CVE-2026-53048 CVE-2026-53059
CVE-2026-53061 CVE-2026-53076 CVE-2026-53077 CVE-2026-53089 CVE-2026-53091
CVE-2026-53092 CVE-2026-53094 CVE-2026-53096 CVE-2026-53109 CVE-2026-53110
CVE-2026-53111 CVE-2026-53114 CVE-2026-53126 CVE-2026-53129 CVE-2026-53142
CVE-2026-53154 CVE-2026-53163 CVE-2026-53180 CVE-2026-53207 CVE-2026-53219
CVE-2026-53220 CVE-2026-53223 CVE-2026-53228 CVE-2026-53238 CVE-2026-53264
CVE-2026-53269 CVE-2026-53284 CVE-2026-53291 CVE-2026-53309 CVE-2026-53330
CVE-2026-53336 CVE-2026-53337 CVE-2026-53341 CVE-2026-53353 CVE-2026-53365
CVE-2026-53388 CVE-2026-53612 CVE-2026-53613 CVE-2026-53614 CVE-2026-63801
CVE-2026-63803 CVE-2026-63804 CVE-2026-63808 CVE-2026-63810 CVE-2026-63823
CVE-2026-63828 CVE-2026-63860 CVE-2026-63865 CVE-2026-63868 CVE-2026-63879
CVE-2026-63887 CVE-2026-63888 CVE-2026-63889 CVE-2026-63890 CVE-2026-63891
CVE-2026-63898 CVE-2026-63901 CVE-2026-63906 CVE-2026-63917 CVE-2026-63918
CVE-2026-63920 CVE-2026-63921 CVE-2026-63922 CVE-2026-63924 CVE-2026-63925
CVE-2026-63926 CVE-2026-63928 CVE-2026-63941 CVE-2026-63969 CVE-2026-63970
CVE-2026-63984 CVE-2026-63985 CVE-2026-63986 CVE-2026-63987 CVE-2026-63990
CVE-2026-63992 CVE-2026-63993 CVE-2026-63995 CVE-2026-63996 CVE-2026-63997
CVE-2026-63998 CVE-2026-63999 CVE-2026-64000 CVE-2026-64001 CVE-2026-64002
CVE-2026-64003 CVE-2026-64004 CVE-2026-64005 CVE-2026-64006 CVE-2026-64007
CVE-2026-64010 CVE-2026-64011 CVE-2026-64014 CVE-2026-64015 CVE-2026-64017
CVE-2026-64024 CVE-2026-64029 CVE-2026-64033 CVE-2026-64039 CVE-2026-64047
CVE-2026-64048 CVE-2026-64051 CVE-2026-64052 CVE-2026-64053 CVE-2026-64054
CVE-2026-64055 CVE-2026-64056 CVE-2026-64071 CVE-2026-64073 CVE-2026-64083
CVE-2026-64084 CVE-2026-64085 CVE-2026-64086 CVE-2026-64087 CVE-2026-64088
CVE-2026-64089 CVE-2026-64093 CVE-2026-64097 CVE-2026-64098 CVE-2026-64099
CVE-2026-64102 CVE-2026-64103 CVE-2026-64104 CVE-2026-64105 CVE-2026-64109
CVE-2026-64111 CVE-2026-64112 CVE-2026-64113 CVE-2026-64114 CVE-2026-64115
CVE-2026-64118 CVE-2026-64119 CVE-2026-64121 CVE-2026-64125 CVE-2026-64126
CVE-2026-64127 CVE-2026-64128 CVE-2026-64131 CVE-2026-64133 CVE-2026-64134
CVE-2026-64135 CVE-2026-64137 CVE-2026-64144 CVE-2026-64146 CVE-2026-64147
CVE-2026-64148 CVE-2026-64155 CVE-2026-64162 CVE-2026-64164 CVE-2026-64166
CVE-2026-64168 CVE-2026-64169 CVE-2026-64170 CVE-2026-64177 CVE-2026-64178
CVE-2026-64179 CVE-2026-64180 CVE-2026-64184 CVE-2026-64185 CVE-2026-64190
CVE-2026-64192 CVE-2026-64210 CVE-2026-64214 CVE-2026-64217 CVE-2026-64219
CVE-2026-64222 CVE-2026-64224 CVE-2026-64225 CVE-2026-64232 CVE-2026-64237
CVE-2026-64239 CVE-2026-64240 CVE-2026-64243 CVE-2026-64244 CVE-2026-64245
CVE-2026-64246 CVE-2026-64247 CVE-2026-64249 CVE-2026-64253 CVE-2026-64256
CVE-2026-64265 CVE-2026-64266 CVE-2026-64268 CVE-2026-64269 CVE-2026-64270
CVE-2026-64271 CVE-2026-64272 CVE-2026-64273 CVE-2026-64274 CVE-2026-64275
CVE-2026-64276 CVE-2026-64277 CVE-2026-64278 CVE-2026-64279 CVE-2026-64283
CVE-2026-64286 CVE-2026-64287 CVE-2026-64294 CVE-2026-64296 CVE-2026-64298
CVE-2026-64300 CVE-2026-64301 CVE-2026-64303 CVE-2026-64304 CVE-2026-64305
CVE-2026-64306 CVE-2026-64307 CVE-2026-64308 CVE-2026-64309 CVE-2026-64310
CVE-2026-64312 CVE-2026-64313 CVE-2026-64315 CVE-2026-64316 CVE-2026-64317
CVE-2026-64319 CVE-2026-64320 CVE-2026-64321 CVE-2026-64322 CVE-2026-64323
CVE-2026-64326 CVE-2026-64327 CVE-2026-64328 CVE-2026-64329 CVE-2026-64331
CVE-2026-64332 CVE-2026-64333 CVE-2026-64334 CVE-2026-64335 CVE-2026-64337
CVE-2026-64338 CVE-2026-64340 CVE-2026-64341 CVE-2026-64342 CVE-2026-64343
CVE-2026-64344 CVE-2026-64346 CVE-2026-64348 CVE-2026-64350 CVE-2026-64351
CVE-2026-64354 CVE-2026-64355 CVE-2026-64358 CVE-2026-64362 CVE-2026-64364
CVE-2026-64365 CVE-2026-64367 CVE-2026-64368 CVE-2026-64373 CVE-2026-64375
CVE-2026-64376 CVE-2026-64378 CVE-2026-64380 CVE-2026-64381 CVE-2026-64382
CVE-2026-64383 CVE-2026-64384 CVE-2026-64385 CVE-2026-64386 CVE-2026-64387
CVE-2026-64401 CVE-2026-64403 CVE-2026-64404 CVE-2026-64406 CVE-2026-64407
CVE-2026-64408 CVE-2026-64409 CVE-2026-64411 CVE-2026-64412 CVE-2026-64415
CVE-2026-64416 CVE-2026-64420 CVE-2026-64421 CVE-2026-64423 CVE-2026-64427
CVE-2026-64429 CVE-2026-64433 CVE-2026-64434 CVE-2026-64436 CVE-2026-64440
CVE-2026-64442 CVE-2026-64443 CVE-2026-64444 CVE-2026-64445 CVE-2026-64446
CVE-2026-64450 CVE-2026-64452 CVE-2026-64454 CVE-2026-64455 CVE-2026-64456
CVE-2026-64458 CVE-2026-64463 CVE-2026-64470 CVE-2026-64471 CVE-2026-64472
CVE-2026-64477 CVE-2026-64478 CVE-2026-64479 CVE-2026-64480 CVE-2026-64481
CVE-2026-64482 CVE-2026-64483 CVE-2026-64484 CVE-2026-64486 CVE-2026-64487
CVE-2026-64489 CVE-2026-64490 CVE-2026-64494 CVE-2026-64495 CVE-2026-64496
CVE-2026-64497 CVE-2026-64499 CVE-2026-64500 CVE-2026-64503 CVE-2026-64504
CVE-2026-64505 CVE-2026-64507 CVE-2026-64511 CVE-2026-64512 CVE-2026-64513
CVE-2026-64515 CVE-2026-64517 CVE-2026-64518 CVE-2026-64519 CVE-2026-64524
CVE-2026-64525 CVE-2026-64526 CVE-2026-64527 CVE-2026-64534 CVE-2026-64535
CVE-2026-64536 CVE-2026-64537 CVE-2026-64538 CVE-2026-64539 CVE-2026-64540
CVE-2026-64541 CVE-2026-64542 CVE-2026-64543 CVE-2026-64544 CVE-2026-64545
CVE-2026-64546 CVE-2026-64547 CVE-2026-64548 CVE-2026-64549 CVE-2026-64551
CVE-2026-64552 CVE-2026-64553 CVE-2026-64554 CVE-2026-64555 CVE-2026-64556
CVE-2026-64558 CVE-2026-64559 CVE-2026-64561 CVE-2026-64562 CVE-2026-64563
CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569 CVE-2026-64570
CVE-2026-64571 CVE-2026-64572 CVE-2026-64573 CVE-2026-64574 CVE-2026-64576
CVE-2026-64577 CVE-2026-64579 CVE-2026-64581 CVE-2026-64582 CVE-2026-64583
CVE-2026-64584 CVE-2026-64585 CVE-2026-64586 CVE-2026-64589 CVE-2026-64593
CVE-2026-64599 CVE-2026-64602 CVE-2026-64603 CVE-2026-64604 CVE-2026-68081
CVE-2026-68082 CVE-2026-68085 CVE-2026-68086 CVE-2026-68088 CVE-2026-68091
CVE-2026-68093 CVE-2026-68096 CVE-2026-68102 CVE-2026-68104 CVE-2026-68105
CVE-2026-68106 CVE-2026-68107 CVE-2026-68108 CVE-2026-68110 CVE-2026-68111
CVE-2026-68112 CVE-2026-68113 CVE-2026-68115 CVE-2026-68116 CVE-2026-68117
CVE-2026-68120 CVE-2026-68121 CVE-2026-68123 CVE-2026-68124 CVE-2026-68125
CVE-2026-68126 CVE-2026-68127 CVE-2026-68128 CVE-2026-68129 CVE-2026-68132
CVE-2026-68133 CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138
CVE-2026-68139 CVE-2026-68141 CVE-2026-68142 CVE-2026-68143 CVE-2026-68144
CVE-2026-68145 CVE-2026-68148 CVE-2026-68149 CVE-2026-68152 CVE-2026-68153
CVE-2026-68154 CVE-2026-68155 CVE-2026-68156 CVE-2026-68157 CVE-2026-68158
CVE-2026-68159 CVE-2026-68161 CVE-2026-68164 CVE-2026-68165 CVE-2026-68166
CVE-2026-68169 CVE-2026-68178 CVE-2026-68179 CVE-2026-68180 CVE-2026-68181
CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68188 CVE-2026-68189
CVE-2026-68192 CVE-2026-68193 CVE-2026-68194 CVE-2026-68195 CVE-2026-68196
CVE-2026-68197 CVE-2026-68198 CVE-2026-68199 CVE-2026-68200 CVE-2026-68201
CVE-2026-68202 CVE-2026-68203 CVE-2026-68204 CVE-2026-68205 CVE-2026-68206
CVE-2026-68207 CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213
CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217 CVE-2026-68218
CVE-2026-68219 CVE-2026-68220 CVE-2026-68221 CVE-2026-68222 CVE-2026-68223
CVE-2026-68225 CVE-2026-68226 CVE-2026-68227 CVE-2026-68228 CVE-2026-68229
CVE-2026-68231 CVE-2026-68234 CVE-2026-68235 CVE-2026-68236 CVE-2026-68238
CVE-2026-68243 CVE-2026-68244 CVE-2026-68245 CVE-2026-68246 CVE-2026-68247
CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68252
CVE-2026-68253 CVE-2026-68254 CVE-2026-68255 CVE-2026-68256 CVE-2026-68257
CVE-2026-68258 CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262
CVE-2026-68263 CVE-2026-68267 CVE-2026-68269 CVE-2026-68271 CVE-2026-68272
CVE-2026-68273 CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280
CVE-2026-68281 CVE-2026-68284 CVE-2026-68286 CVE-2026-68288 CVE-2026-68289
CVE-2026-68293 CVE-2026-68294 CVE-2026-68296 CVE-2026-68297 CVE-2026-68299
CVE-2026-68300 CVE-2026-68302 CVE-2026-68303 CVE-2026-68304 CVE-2026-68306
CVE-2026-68307 CVE-2026-68308 CVE-2026-68309 CVE-2026-68310 CVE-2026-68311
CVE-2026-68313 CVE-2026-68315 CVE-2026-68319 CVE-2026-68320 CVE-2026-68321
CVE-2026-68322 CVE-2026-68325 CVE-2026-68326 CVE-2026-68327 CVE-2026-68328
CVE-2026-68329 CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336
CVE-2026-68338 CVE-2026-68339 CVE-2026-68340 CVE-2026-68344 CVE-2026-68346
CVE-2026-68348 CVE-2026-68349 CVE-2026-68350 CVE-2026-68351 CVE-2026-68352
CVE-2026-68353 CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68358
CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363
CVE-2026-68365 CVE-2026-68366 CVE-2026-68368 CVE-2026-68369 CVE-2026-68370
CVE-2026-68371 CVE-2026-68372 CVE-2026-68373 CVE-2026-68374 CVE-2026-68375
CVE-2026-68377 CVE-2026-68386 CVE-2026-68389 CVE-2026-68391 CVE-2026-68392
CVE-2026-68393 CVE-2026-68394 CVE-2026-68395 CVE-2026-68397 CVE-2026-68398
CVE-2026-68399 CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406
CVE-2026-68407 CVE-2026-68408 CVE-2026-68410 CVE-2026-68413 CVE-2026-68414
CVE-2026-68416 CVE-2026-68417 CVE-2026-68418 CVE-2026-68419 CVE-2026-68422
CVE-2026-68425 CVE-2026-68426 CVE-2026-68427 CVE-2026-68428 CVE-2026-68429
CVE-2026-68430 CVE-2026-68432 CVE-2026-68433 CVE-2026-68434 CVE-2026-68437
CVE-2026-68439 CVE-2026-68442 CVE-2026-68443 CVE-2026-68444 CVE-2026-68445
CVE-2026-68446 CVE-2026-68448 CVE-2026-68450 CVE-2026-68470 CVE-2026-68480
CVE-2026-72017 CVE-2026-72019 CVE-2026-72020 CVE-2026-72022 CVE-2026-72023
CVE-2026-72032 CVE-2026-72034 CVE-2026-72035 CVE-2026-72036 CVE-2026-72045
CVE-2026-72046 CVE-2026-72051 CVE-2026-72052 CVE-2026-72053 CVE-2026-72054
CVE-2026-72055 CVE-2026-72061 CVE-2026-72069 CVE-2026-72072 CVE-2026-72083
CVE-2026-72084 CVE-2026-72100 CVE-2026-72101 CVE-2026-72103 CVE-2026-72106
CVE-2026-72107 CVE-2026-72108 CVE-2026-72132 CVE-2026-72136 CVE-2026-72137
CVE-2026-72161 CVE-2026-72163 CVE-2026-72164 CVE-2026-72176 CVE-2026-72177
CVE-2026-72217 CVE-2026-72221 CVE-2026-72222 CVE-2026-72234 CVE-2026-72242
CVE-2026-72243 CVE-2026-72251 CVE-2026-72254 CVE-2026-72280 CVE-2026-72282
CVE-2026-72288 CVE-2026-72289 CVE-2026-72296 CVE-2026-72297 CVE-2026-72306
CVE-2026-72307 CVE-2026-72308 CVE-2026-72317 CVE-2026-72323 CVE-2026-72325
CVE-2026-72330 CVE-2026-72337 CVE-2026-72339 CVE-2026-72341 CVE-2026-72342
CVE-2026-72343 CVE-2026-72345 CVE-2026-72347 CVE-2026-72350 CVE-2026-72366
CVE-2026-72379 CVE-2026-72389 CVE-2026-72398 CVE-2026-72399 CVE-2026-72414
CVE-2026-72421 CVE-2026-72425 CVE-2026-72430 CVE-2026-72437 CVE-2026-72438
CVE-2026-72439 CVE-2026-72440 CVE-2026-72448 CVE-2026-72450 CVE-2026-72459
CVE-2026-72460 CVE-2026-72464 CVE-2026-72466 CVE-2026-72467 CVE-2026-72468
CVE-2026-72469 CVE-2026-72473 CVE-2026-72485 CVE-2026-72487 CVE-2026-72488
CVE-2026-72494 CVE-2026-72495 CVE-2026-72497 CVE-2026-72499 CVE-2026-72500
CVE-2026-72501 CVE-2026-72502 CVE-2026-74255 CVE-2026-74261 CVE-2026-74269
CVE-2026-74270 CVE-2026-74282 CVE-2026-74284 CVE-2026-74286 CVE-2026-74296
CVE-2026-74297 CVE-2026-74307 CVE-2026-74308 CVE-2026-74313 CVE-2026-74316
CVE-2026-74317 CVE-2026-74318 CVE-2026-74321 CVE-2026-74334 CVE-2026-74345
CVE-2026-74346 CVE-2026-74349 CVE-2026-74363 CVE-2026-74375 CVE-2026-74377
CVE-2026-74378 CVE-2026-74382 CVE-2026-74388 CVE-2026-74390 CVE-2026-74394
CVE-2026-74395 CVE-2026-74397 CVE-2026-74406 CVE-2026-74464 CVE-2026-74474
CVE-2026-74475 CVE-2026-74476 CVE-2026-74479 CVE-2026-74481 CVE-2026-74482
CVE-2026-74495 CVE-2026-74496 CVE-2026-74510 CVE-2026-74512 CVE-2026-74513
CVE-2026-74517 CVE-2026-74518 CVE-2026-74523 CVE-2026-74527 CVE-2026-74533
CVE-2026-74534 CVE-2026-74535 CVE-2026-74536 CVE-2026-74537 CVE-2026-74545
CVE-2026-74548 CVE-2026-74550 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557
CVE-2026-74563 CVE-2026-74566 CVE-2026-74567 CVE-2026-74571 CVE-2026-74577
CVE-2026-74581 CVE-2026-74582 CVE-2026-74584 CVE-2026-74598 CVE-2026-74610
CVE-2026-74612 CVE-2026-74615 CVE-2026-74616 CVE-2026-74622 CVE-2026-74644
CVE-2026-74665 CVE-2026-74669 CVE-2026-74695 CVE-2026-74705 CVE-2026-74712
CVE-2026-74717 CVE-2026-74719 CVE-2026-74722 CVE-2026-74723 CVE-2026-74730
CVE-2026-74737 CVE-2026-74743 CVE-2026-74744 CVE-2026-76642 CVE-2026-78408
CVE-2026-78410 CVE-2026-80529 CVE-2026-80530 CVE-2026-80531 CVE-2026-80533
CVE-2026-80534 CVE-2026-80535 CVE-2026-80557 CVE-2026-80558 CVE-2026-80561
CVE-2026-80586 CVE-2026-80589 CVE-2026-80590 CVE-2026-80603 CVE-2026-80609
CVE-2026-80629 CVE-2026-80646 CVE-2026-80647 CVE-2026-80667 CVE-2026-80681
CVE-2026-80693 CVE-2026-80714 CVE-2026-80721 CVE-2026-80727 CVE-2026-80731
CVE-2026-80737 CVE-2026-80739 CVE-2026-80805 CVE-2026-80813 CVE-2026-80838
-----------------------------------------------------------------
The container suse/sl-micro/6.2/kvm-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1733
Released: Tue Sep 22 09:23:33 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,1270219,1275441,1278347,1278348,1278349,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614,CVE-2026-76642,CVE-2026-78408,CVE-2026-78410
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
-----------------------------------------------------------------
Advisory ID: 1738
Released: Tue Sep 22 16:23:31 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1236344,1240890,1240957,1249104,1255225,1255531,1256629,1256671,1258278,1260501,1260577,1262073,1262756,1263004,1263864,1263865,1264267,1264335,1264444,1264541,1264587,1264619,1264807,1264851,1265036,1265068,1265121,1265132,1265141,1265220,1266710,1266860,1266874,1266897,1266928,1267023,1267238,1267373,1267501,1267586,1267612,1267882,1267985,1268972,1268979,1269000,1269004,1269010,1269013,1269108,1269113,1269114,1269126,1269134,1269140,1269162,1269167,1269238,1269242,1269256,1269301,1269306,1269380,1269381,1269388,1269402,1269412,1269417,1269528,1269530,1269579,1269590,1269633,1269635,1269655,1269665,1269685,1269686,1269695,1269697,1269774,1269783,1269792,1269815,1269816,1269888,1269965,1269969,1269985,1269999,1270090,1270108,1270111,1270139,1270251,1270266,1270267,1271050,1271256,1271365,1271825,1272148,1272149,1272175,1272182,1272199,1272200,1272210,1272213,1272230,1272260,1272261,1272262,1272284,1272287,1272297,1272346,1272366,1272385,1272390,1272423,1272426,1272429,1
272484,1272486,1272497,1272501,1272502,1272513,1272516,1272568,1272569,1272584,1272641,1272643,1272673,1272756,1272786,1272788,1272791,1272798,1272799,1272804,1272855,1272865,1272868,1272869,1272877,1272891,1272893,1272894,1272904,1272905,1272918,1272963,1272969,1272971,1272983,1272985,1273008,1273019,1273027,1273030,1273032,1273033,1273036,1273037,1273038,1273060,1273105,1273107,1273119,1273134,1273231,1273249,1273251,1273260,1273271,1273273,1273274,1273276,1273277,1273280,1273281,1273283,1273284,1273285,1273286,1273288,1273289,1273291,1273294,1273302,1273303,1273305,1273309,1273310,1273311,1273312,1273314,1273316,1273317,1273318,1273319,1273323,1273325,1273327,1273331,1273334,1273335,1273336,1273337,1273338,1273339,1273340,1273341,1273346,1273420,1273422,1273426,1273443,1273460,1273461,1273463,1273465,1273468,1273469,1273471,1273479,1273480,1273482,1273484,1273486,1273488,1273490,1273495,1273501,1273503,1273504,1273506,1273507,1273509,1273511,1273520,1273523,1273524,1273525,127353
3,1273536,1273538,1273542,1273550,1273555,1273557,1273567,1273578,1273579,1273581,1273582,1273596,1273597,1273598,1273600,1273601,1273602,1273603,1273679,1273681,1273682,1273734,1273737,1273738,1273739,1273740,1273741,1273742,1273743,1273744,1273745,1273746,1273748,1273749,1273755,1273759,1273762,1273765,1273766,1273769,1273770,1273774,1273776,1273778,1273780,1273782,1273788,1273790,1273796,1273797,1273801,1273803,1273804,1273809,1273810,1273811,1273812,1273813,1273817,1273822,1273824,1273831,1273834,1273838,1273839,1273842,1273844,1273848,1273849,1273852,1273855,1273859,1273860,1273862,1273864,1273866,1273867,1273868,1273869,1273870,1273872,1273876,1273877,1273880,1273882,1273890,1273891,1273892,1273895,1273896,1273898,1273899,1273903,1273904,1273905,1273930,1273933,1273934,1273935,1273936,1273939,1273940,1273941,1273942,1273944,1273945,1273946,1273947,1273949,1273953,1273954,1273956,1273957,1273958,1273959,1273963,1273966,1273967,1273968,1273972,1273974,1273975,1273977,1273988,127
3990,1273991,1273995,1273997,1273999,1274001,1274003,1274006,1274008,1274009,1274010,1274011,1274012,1274014,1274017,1274019,1274020,1274026,1274028,1274030,1274031,1274035,1274036,1274040,1274041,1274052,1274055,1274057,1274058,1274060,1274063,1274065,1274067,1274071,1274075,1274076,1274077,1274078,1274208,1274226,1274239,1274243,1274252,1274253,1274258,1274264,1274265,1274267,1274274,1274277,1274278,1274281,1274283,1274286,1274290,1274292,1274294,1274295,1274296,1274314,1274321,1274491,1274492,1274494,1274497,1274539,1274541,1274543,1274545,1274547,1274550,1274556,1274573,1274578,1274580,1274581,1274622,1274624,1274628,1274632,1274636,1274637,1274639,1274640,1274642,1274644,1274645,1274646,1274650,1274651,1274652,1274656,1274657,1274659,1274662,1274665,1274667,1274669,1274670,1274671,1274675,1274677,1274678,1274679,1274681,1274682,1274690,1274694,1274696,1274698,1274699,1274700,1274702,1274703,1274705,1274706,1274707,1274709,1274710,1274713,1274716,1274721,1274725,1274727,1274730,
1274737,1274738,1274749,1274750,1274751,1274752,1274753,1274754,1274755,1274756,1274764,1274768,1274770,1274771,1274773,1274782,1274783,1274787,1274800,1274801,1274802,1274803,1274804,1274805,1274807,1274808,1274811,1274813,1274814,1274831,1274834,1274835,1274838,1274847,1274849,1274853,1274868,1274869,1274872,1274873,1274874,1274876,1274877,1274879,1274881,1274883,1274886,1274887,1274888,1274891,1274892,1274893,1274894,1274895,1274896,1274897,1274898,1274899,1274900,1274901,1274902,1274904,1274905,1274906,1274907,1274908,1274913,1274914,1274921,1274924,1274925,1274927,1274929,1274930,1274933,1274934,1274935,1274938,1274939,1274940,1274941,1274945,1274947,1274951,1274952,1274953,1274955,1274957,1274958,1274965,1274968,1274978,1274981,1275040,1275045,1275069,1275071,1275072,1275073,1275076,1275080,1275081,1275083,1275088,1275091,1275092,1275094,1275125,1275126,1275129,1275131,1275132,1275139,1275141,1275146,1275148,1275149,1275150,1275152,1275154,1275155,1275156,1275157,1275158,12751
60,1275161,1275163,1275164,1275169,1275173,1275176,1275185,1275190,1275192,1275229,1275236,1275237,1275238,1275239,1275294,1275300,1275301,1275303,1275304,1275305,1275306,1275307,1275470,1275474,1275479,1275481,1275483,1275486,1275487,1275496,1275506,1275509,1275511,1275514,1275517,1275519,1275528,1275535,1275540,1275553,1275555,1275557,1275561,1275566,1275569,1275572,1275574,1275578,1275582,1275583,1275584,1275587,1275588,1275591,1275595,1275596,1275633,1275636,1275650,1275655,1275656,1275659,1275665,1275669,1275672,1275679,1275685,1275687,1275688,1275690,1275695,1275696,1275704,1275737,1275782,1275784,1275787,1275788,1275789,1275790,1275798,1275799,1275801,1275802,1275804,1275805,1275812,1275817,1275818,1275819,1275820,1275821,1275822,1275823,1275827,1275864,1275866,1275867,1275869,1275870,1275871,1275872,1275886,1275905,1275923,1275925,1275928,1275950,1275954,1275956,1275970,1275973,1275975,1275976,1275985,1276006,1276029,1276257,1276258,1276263,1276265,1276267,1276270,1276273,12
76277,1276333,1276335,1276339,1276341,1276346,1276354,1276355,1276381,1276395,1276446,1276452,1276468,1276471,1276473,1276500,1276507,1276512,1276528,1276542,1276546,1276547,1276551,1276552,1276553,1276561,1276562,1276566,1276569,1276572,1276577,1276586,1276665,1276766,1276767,1276771,1276785,1276793,1276801,1276803,1276814,1276818,1276821,1276831,1276840,1276864,1276865,1276866,1276870,1276876,1276880,1276905,1276913,1276922,1276931,1276937,1276941,1276955,1276957,1276961,1277022,1277023,1277033,1277034,1277037,1277047,1277054,1277057,1277059,1277062,1277066,1277069,1277070,1277077,1277078,1277092,1277095,1277108,1277114,1277115,1277118,1277120,1277155,1277159,1277160,1277202,1277204,1277227,1277229,1277230,1277231,1277233,1277249,1277254,1277265,1277268,1277275,1277285,1277308,1277311,1277315,1277321,1277328,1277335,1277349,1277350,1277391,1277407,1277408,1277485,1277505,1277513,1277551,1277553,1277561,1277574,1277636,1277641,1277649,1277655,1277656,1277660,1277668,1277680,1277688
,1277726,1277728,1277738,1277748,1277761,1277764,1277773,1277775,1277776,1277782,1277783,1277813,1277818,1277822,1277845,1277862,1277874,1277876,1277898,1277901,1277908,1277918,1278039,1278070,1278088,1278094,1278098,1278113,1278155,1278180,1278233,1278236,1278240,1278253,1278293,1278324,1278331,1278334,1278395,1278416,1278703,1278716,1278733,1279487,1279537,1279580,1279813,1279842,1279847,1279887,1280139,CVE-2025-68214,CVE-2025-68358,CVE-2025-68780,CVE-2025-71075,CVE-2026-23113,CVE-2026-23306,CVE-2026-23348,CVE-2026-31418,CVE-2026-31530,CVE-2026-31531,CVE-2026-43116,CVE-2026-43125,CVE-2026-43163,CVE-2026-43239,CVE-2026-43271,CVE-2026-43299,CVE-2026-43331,CVE-2026-43355,CVE-2026-43363,CVE-2026-43416,CVE-2026-43439,CVE-2026-43448,CVE-2026-45860,CVE-2026-45897,CVE-2026-45968,CVE-2026-46007,CVE-2026-46070,CVE-2026-46091,CVE-2026-46107,CVE-2026-46115,CVE-2026-46133,CVE-2026-46135,CVE-2026-46195,CVE-2026-46304,CVE-2026-52912,CVE-2026-52920,CVE-2026-52928,CVE-2026-52929,CVE-2026-52935,CVE
-2026-52939,CVE-2026-52946,CVE-2026-52977,CVE-2026-52990,CVE-2026-52991,CVE-2026-52994,CVE-2026-53001,CVE-2026-53031,CVE-2026-53033,CVE-2026-53034,CVE-2026-53048,CVE-2026-53059,CVE-2026-53061,CVE-2026-53076,CVE-2026-53077,CVE-2026-53089,CVE-2026-53091,CVE-2026-53092,CVE-2026-53094,CVE-2026-53096,CVE-2026-53109,CVE-2026-53110,CVE-2026-53111,CVE-2026-53114,CVE-2026-53126,CVE-2026-53129,CVE-2026-53142,CVE-2026-53154,CVE-2026-53163,CVE-2026-53180,CVE-2026-53207,CVE-2026-53219,CVE-2026-53220,CVE-2026-53223,CVE-2026-53228,CVE-2026-53238,CVE-2026-53264,CVE-2026-53269,CVE-2026-53284,CVE-2026-53291,CVE-2026-53309,CVE-2026-53330,CVE-2026-53336,CVE-2026-53337,CVE-2026-53341,CVE-2026-53353,CVE-2026-53365,CVE-2026-53388,CVE-2026-63801,CVE-2026-63803,CVE-2026-63804,CVE-2026-63808,CVE-2026-63810,CVE-2026-63823,CVE-2026-63828,CVE-2026-63860,CVE-2026-63865,CVE-2026-63868,CVE-2026-63879,CVE-2026-63887,CVE-2026-63888,CVE-2026-63889,CVE-2026-63890,CVE-2026-63891,CVE-2026-63898,CVE-2026-63901,CVE-2026-6
3906,CVE-2026-63917,CVE-2026-63918,CVE-2026-63920,CVE-2026-63921,CVE-2026-63922,CVE-2026-63924,CVE-2026-63925,CVE-2026-63926,CVE-2026-63928,CVE-2026-63941,CVE-2026-63969,CVE-2026-63970,CVE-2026-63984,CVE-2026-63985,CVE-2026-63986,CVE-2026-63987,CVE-2026-63990,CVE-2026-63992,CVE-2026-63993,CVE-2026-63995,CVE-2026-63996,CVE-2026-63997,CVE-2026-63998,CVE-2026-63999,CVE-2026-64000,CVE-2026-64001,CVE-2026-64002,CVE-2026-64003,CVE-2026-64004,CVE-2026-64005,CVE-2026-64006,CVE-2026-64007,CVE-2026-64010,CVE-2026-64011,CVE-2026-64014,CVE-2026-64015,CVE-2026-64017,CVE-2026-64024,CVE-2026-64029,CVE-2026-64033,CVE-2026-64039,CVE-2026-64047,CVE-2026-64048,CVE-2026-64051,CVE-2026-64052,CVE-2026-64053,CVE-2026-64054,CVE-2026-64055,CVE-2026-64056,CVE-2026-64071,CVE-2026-64073,CVE-2026-64083,CVE-2026-64084,CVE-2026-64085,CVE-2026-64086,CVE-2026-64087,CVE-2026-64088,CVE-2026-64089,CVE-2026-64093,CVE-2026-64097,CVE-2026-64098,CVE-2026-64099,CVE-2026-64102,CVE-2026-64103,CVE-2026-64104,CVE-2026-64105,CV
E-2026-64109,CVE-2026-64111,CVE-2026-64112,CVE-2026-64113,CVE-2026-64114,CVE-2026-64115,CVE-2026-64118,CVE-2026-64119,CVE-2026-64121,CVE-2026-64125,CVE-2026-64126,CVE-2026-64127,CVE-2026-64128,CVE-2026-64131,CVE-2026-64133,CVE-2026-64134,CVE-2026-64135,CVE-2026-64137,CVE-2026-64144,CVE-2026-64146,CVE-2026-64147,CVE-2026-64148,CVE-2026-64155,CVE-2026-64162,CVE-2026-64164,CVE-2026-64166,CVE-2026-64168,CVE-2026-64169,CVE-2026-64170,CVE-2026-64177,CVE-2026-64178,CVE-2026-64179,CVE-2026-64180,CVE-2026-64184,CVE-2026-64185,CVE-2026-64190,CVE-2026-64192,CVE-2026-64210,CVE-2026-64214,CVE-2026-64217,CVE-2026-64219,CVE-2026-64222,CVE-2026-64224,CVE-2026-64225,CVE-2026-64232,CVE-2026-64237,CVE-2026-64239,CVE-2026-64240,CVE-2026-64243,CVE-2026-64244,CVE-2026-64245,CVE-2026-64246,CVE-2026-64247,CVE-2026-64249,CVE-2026-64253,CVE-2026-64256,CVE-2026-64265,CVE-2026-64266,CVE-2026-64268,CVE-2026-64269,CVE-2026-64270,CVE-2026-64271,CVE-2026-64272,CVE-2026-64273,CVE-2026-64274,CVE-2026-64275,CVE-2026-
64276,CVE-2026-64277,CVE-2026-64278,CVE-2026-64279,CVE-2026-64283,CVE-2026-64286,CVE-2026-64287,CVE-2026-64294,CVE-2026-64296,CVE-2026-64298,CVE-2026-64300,CVE-2026-64301,CVE-2026-64303,CVE-2026-64304,CVE-2026-64305,CVE-2026-64306,CVE-2026-64307,CVE-2026-64308,CVE-2026-64309,CVE-2026-64310,CVE-2026-64312,CVE-2026-64313,CVE-2026-64315,CVE-2026-64316,CVE-2026-64317,CVE-2026-64319,CVE-2026-64320,CVE-2026-64321,CVE-2026-64322,CVE-2026-64323,CVE-2026-64326,CVE-2026-64327,CVE-2026-64328,CVE-2026-64329,CVE-2026-64331,CVE-2026-64332,CVE-2026-64333,CVE-2026-64334,CVE-2026-64335,CVE-2026-64337,CVE-2026-64338,CVE-2026-64340,CVE-2026-64341,CVE-2026-64342,CVE-2026-64343,CVE-2026-64344,CVE-2026-64346,CVE-2026-64348,CVE-2026-64350,CVE-2026-64351,CVE-2026-64354,CVE-2026-64355,CVE-2026-64358,CVE-2026-64362,CVE-2026-64364,CVE-2026-64365,CVE-2026-64367,CVE-2026-64368,CVE-2026-64373,CVE-2026-64375,CVE-2026-64376,CVE-2026-64378,CVE-2026-64380,CVE-2026-64381,CVE-2026-64382,CVE-2026-64383,CVE-2026-64384,C
VE-2026-64385,CVE-2026-64386,CVE-2026-64387,CVE-2026-64401,CVE-2026-64403,CVE-2026-64404,CVE-2026-64406,CVE-2026-64407,CVE-2026-64408,CVE-2026-64409,CVE-2026-64411,CVE-2026-64412,CVE-2026-64415,CVE-2026-64416,CVE-2026-64420,CVE-2026-64421,CVE-2026-64423,CVE-2026-64427,CVE-2026-64429,CVE-2026-64433,CVE-2026-64434,CVE-2026-64436,CVE-2026-64440,CVE-2026-64442,CVE-2026-64443,CVE-2026-64444,CVE-2026-64445,CVE-2026-64446,CVE-2026-64450,CVE-2026-64452,CVE-2026-64454,CVE-2026-64455,CVE-2026-64456,CVE-2026-64458,CVE-2026-64463,CVE-2026-64470,CVE-2026-64471,CVE-2026-64472,CVE-2026-64477,CVE-2026-64478,CVE-2026-64479,CVE-2026-64480,CVE-2026-64481,CVE-2026-64482,CVE-2026-64483,CVE-2026-64484,CVE-2026-64486,CVE-2026-64487,CVE-2026-64489,CVE-2026-64490,CVE-2026-64494,CVE-2026-64495,CVE-2026-64496,CVE-2026-64497,CVE-2026-64499,CVE-2026-64500,CVE-2026-64503,CVE-2026-64504,CVE-2026-64505,CVE-2026-64507,CVE-2026-64511,CVE-2026-64512,CVE-2026-64513,CVE-2026-64515,CVE-2026-64517,CVE-2026-64518,CVE-2026
-64519,CVE-2026-64524,CVE-2026-64525,CVE-2026-64526,CVE-2026-64527,CVE-2026-64534,CVE-2026-64535,CVE-2026-64536,CVE-2026-64537,CVE-2026-64538,CVE-2026-64539,CVE-2026-64540,CVE-2026-64541,CVE-2026-64542,CVE-2026-64543,CVE-2026-64544,CVE-2026-64545,CVE-2026-64546,CVE-2026-64547,CVE-2026-64548,CVE-2026-64549,CVE-2026-64551,CVE-2026-64552,CVE-2026-64553,CVE-2026-64554,CVE-2026-64555,CVE-2026-64556,CVE-2026-64558,CVE-2026-64559,CVE-2026-64561,CVE-2026-64562,CVE-2026-64563,CVE-2026-64565,CVE-2026-64567,CVE-2026-64568,CVE-2026-64569,CVE-2026-64570,CVE-2026-64571,CVE-2026-64572,CVE-2026-64573,CVE-2026-64574,CVE-2026-64576,CVE-2026-64577,CVE-2026-64579,CVE-2026-64581,CVE-2026-64582,CVE-2026-64583,CVE-2026-64584,CVE-2026-64585,CVE-2026-64586,CVE-2026-64589,CVE-2026-64593,CVE-2026-64599,CVE-2026-64602,CVE-2026-64603,CVE-2026-64604,CVE-2026-68081,CVE-2026-68082,CVE-2026-68085,CVE-2026-68086,CVE-2026-68088,CVE-2026-68091,CVE-2026-68093,CVE-2026-68096,CVE-2026-68102,CVE-2026-68104,CVE-2026-68105,
CVE-2026-68106,CVE-2026-68107,CVE-2026-68108,CVE-2026-68110,CVE-2026-68111,CVE-2026-68112,CVE-2026-68113,CVE-2026-68115,CVE-2026-68116,CVE-2026-68117,CVE-2026-68120,CVE-2026-68121,CVE-2026-68123,CVE-2026-68124,CVE-2026-68125,CVE-2026-68126,CVE-2026-68127,CVE-2026-68128,CVE-2026-68129,CVE-2026-68132,CVE-2026-68133,CVE-2026-68135,CVE-2026-68136,CVE-2026-68137,CVE-2026-68138,CVE-2026-68139,CVE-2026-68141,CVE-2026-68142,CVE-2026-68143,CVE-2026-68144,CVE-2026-68145,CVE-2026-68148,CVE-2026-68149,CVE-2026-68152,CVE-2026-68153,CVE-2026-68154,CVE-2026-68155,CVE-2026-68156,CVE-2026-68157,CVE-2026-68158,CVE-2026-68159,CVE-2026-68161,CVE-2026-68164,CVE-2026-68165,CVE-2026-68166,CVE-2026-68169,CVE-2026-68178,CVE-2026-68179,CVE-2026-68180,CVE-2026-68181,CVE-2026-68182,CVE-2026-68183,CVE-2026-68184,CVE-2026-68188,CVE-2026-68189,CVE-2026-68192,CVE-2026-68193,CVE-2026-68194,CVE-2026-68195,CVE-2026-68196,CVE-2026-68197,CVE-2026-68198,CVE-2026-68199,CVE-2026-68200,CVE-2026-68201,CVE-2026-68202,CVE-202
6-68203,CVE-2026-68204,CVE-2026-68205,CVE-2026-68206,CVE-2026-68207,CVE-2026-68209,CVE-2026-68210,CVE-2026-68212,CVE-2026-68213,CVE-2026-68214,CVE-2026-68215,CVE-2026-68216,CVE-2026-68217,CVE-2026-68218,CVE-2026-68219,CVE-2026-68220,CVE-2026-68221,CVE-2026-68222,CVE-2026-68223,CVE-2026-68225,CVE-2026-68226,CVE-2026-68227,CVE-2026-68228,CVE-2026-68229,CVE-2026-68231,CVE-2026-68234,CVE-2026-68235,CVE-2026-68236,CVE-2026-68238,CVE-2026-68243,CVE-2026-68244,CVE-2026-68245,CVE-2026-68246,CVE-2026-68247,CVE-2026-68248,CVE-2026-68249,CVE-2026-68250,CVE-2026-68251,CVE-2026-68252,CVE-2026-68253,CVE-2026-68254,CVE-2026-68255,CVE-2026-68256,CVE-2026-68257,CVE-2026-68258,CVE-2026-68259,CVE-2026-68260,CVE-2026-68261,CVE-2026-68262,CVE-2026-68263,CVE-2026-68267,CVE-2026-68269,CVE-2026-68271,CVE-2026-68272,CVE-2026-68273,CVE-2026-68277,CVE-2026-68278,CVE-2026-68279,CVE-2026-68280,CVE-2026-68281,CVE-2026-68284,CVE-2026-68286,CVE-2026-68288,CVE-2026-68289,CVE-2026-68293,CVE-2026-68294,CVE-2026-68296
,CVE-2026-68297,CVE-2026-68299,CVE-2026-68300,CVE-2026-68302,CVE-2026-68303,CVE-2026-68304,CVE-2026-68306,CVE-2026-68307,CVE-2026-68308,CVE-2026-68309,CVE-2026-68310,CVE-2026-68311,CVE-2026-68313,CVE-2026-68315,CVE-2026-68319,CVE-2026-68320,CVE-2026-68321,CVE-2026-68322,CVE-2026-68325,CVE-2026-68326,CVE-2026-68327,CVE-2026-68328,CVE-2026-68329,CVE-2026-68331,CVE-2026-68333,CVE-2026-68335,CVE-2026-68336,CVE-2026-68338,CVE-2026-68339,CVE-2026-68340,CVE-2026-68344,CVE-2026-68346,CVE-2026-68348,CVE-2026-68349,CVE-2026-68350,CVE-2026-68351,CVE-2026-68352,CVE-2026-68353,CVE-2026-68354,CVE-2026-68355,CVE-2026-68357,CVE-2026-68358,CVE-2026-68359,CVE-2026-68360,CVE-2026-68361,CVE-2026-68362,CVE-2026-68363,CVE-2026-68365,CVE-2026-68366,CVE-2026-68368,CVE-2026-68369,CVE-2026-68370,CVE-2026-68371,CVE-2026-68372,CVE-2026-68373,CVE-2026-68374,CVE-2026-68375,CVE-2026-68377,CVE-2026-68386,CVE-2026-68389,CVE-2026-68391,CVE-2026-68392,CVE-2026-68393,CVE-2026-68394,CVE-2026-68395,CVE-2026-68397,CVE-20
26-68398,CVE-2026-68399,CVE-2026-68402,CVE-2026-68403,CVE-2026-68405,CVE-2026-68406,CVE-2026-68407,CVE-2026-68408,CVE-2026-68410,CVE-2026-68413,CVE-2026-68414,CVE-2026-68416,CVE-2026-68417,CVE-2026-68418,CVE-2026-68419,CVE-2026-68422,CVE-2026-68425,CVE-2026-68426,CVE-2026-68427,CVE-2026-68428,CVE-2026-68429,CVE-2026-68430,CVE-2026-68432,CVE-2026-68433,CVE-2026-68434,CVE-2026-68437,CVE-2026-68439,CVE-2026-68442,CVE-2026-68443,CVE-2026-68444,CVE-2026-68445,CVE-2026-68446,CVE-2026-68448,CVE-2026-68450,CVE-2026-68470,CVE-2026-68480,CVE-2026-72017,CVE-2026-72019,CVE-2026-72020,CVE-2026-72022,CVE-2026-72023,CVE-2026-72032,CVE-2026-72034,CVE-2026-72035,CVE-2026-72036,CVE-2026-72045,CVE-2026-72046,CVE-2026-72051,CVE-2026-72052,CVE-2026-72053,CVE-2026-72054,CVE-2026-72055,CVE-2026-72061,CVE-2026-72069,CVE-2026-72072,CVE-2026-72083,CVE-2026-72084,CVE-2026-72100,CVE-2026-72101,CVE-2026-72103,CVE-2026-72106,CVE-2026-72107,CVE-2026-72108,CVE-2026-72132,CVE-2026-72136,CVE-2026-72137,CVE-2026-7216
1,CVE-2026-72163,CVE-2026-72164,CVE-2026-72176,CVE-2026-72177,CVE-2026-72217,CVE-2026-72221,CVE-2026-72222,CVE-2026-72234,CVE-2026-72242,CVE-2026-72243,CVE-2026-72251,CVE-2026-72254,CVE-2026-72280,CVE-2026-72282,CVE-2026-72288,CVE-2026-72289,CVE-2026-72296,CVE-2026-72297,CVE-2026-72306,CVE-2026-72307,CVE-2026-72308,CVE-2026-72317,CVE-2026-72323,CVE-2026-72325,CVE-2026-72330,CVE-2026-72337,CVE-2026-72339,CVE-2026-72341,CVE-2026-72342,CVE-2026-72343,CVE-2026-72345,CVE-2026-72347,CVE-2026-72350,CVE-2026-72366,CVE-2026-72379,CVE-2026-72389,CVE-2026-72398,CVE-2026-72399,CVE-2026-72414,CVE-2026-72421,CVE-2026-72425,CVE-2026-72430,CVE-2026-72437,CVE-2026-72438,CVE-2026-72439,CVE-2026-72440,CVE-2026-72448,CVE-2026-72450,CVE-2026-72459,CVE-2026-72460,CVE-2026-72464,CVE-2026-72466,CVE-2026-72467,CVE-2026-72468,CVE-2026-72469,CVE-2026-72473,CVE-2026-72485,CVE-2026-72487,CVE-2026-72488,CVE-2026-72494,CVE-2026-72495,CVE-2026-72497,CVE-2026-72499,CVE-2026-72500,CVE-2026-72501,CVE-2026-72502,CVE-2
026-74255,CVE-2026-74261,CVE-2026-74269,CVE-2026-74270,CVE-2026-74282,CVE-2026-74284,CVE-2026-74286,CVE-2026-74296,CVE-2026-74297,CVE-2026-74307,CVE-2026-74308,CVE-2026-74313,CVE-2026-74316,CVE-2026-74317,CVE-2026-74318,CVE-2026-74321,CVE-2026-74334,CVE-2026-74345,CVE-2026-74346,CVE-2026-74349,CVE-2026-74363,CVE-2026-74375,CVE-2026-74377,CVE-2026-74378,CVE-2026-74382,CVE-2026-74388,CVE-2026-74390,CVE-2026-74394,CVE-2026-74395,CVE-2026-74397,CVE-2026-74406,CVE-2026-74464,CVE-2026-74474,CVE-2026-74475,CVE-2026-74476,CVE-2026-74479,CVE-2026-74481,CVE-2026-74482,CVE-2026-74495,CVE-2026-74496,CVE-2026-74510,CVE-2026-74512,CVE-2026-74513,CVE-2026-74517,CVE-2026-74518,CVE-2026-74523,CVE-2026-74527,CVE-2026-74533,CVE-2026-74534,CVE-2026-74535,CVE-2026-74536,CVE-2026-74537,CVE-2026-74545,CVE-2026-74548,CVE-2026-74550,CVE-2026-74555,CVE-2026-74556,CVE-2026-74557,CVE-2026-74563,CVE-2026-74566,CVE-2026-74567,CVE-2026-74571,CVE-2026-74577,CVE-2026-74581,CVE-2026-74582,CVE-2026-74584,CVE-2026-745
98,CVE-2026-74610,CVE-2026-74612,CVE-2026-74615,CVE-2026-74616,CVE-2026-74622,CVE-2026-74644,CVE-2026-74665,CVE-2026-74669,CVE-2026-74695,CVE-2026-74705,CVE-2026-74712,CVE-2026-74717,CVE-2026-74719,CVE-2026-74722,CVE-2026-74723,CVE-2026-74730,CVE-2026-74737,CVE-2026-74743,CVE-2026-74744,CVE-2026-80529,CVE-2026-80530,CVE-2026-80531,CVE-2026-80533,CVE-2026-80534,CVE-2026-80535,CVE-2026-80557,CVE-2026-80558,CVE-2026-80561,CVE-2026-80586,CVE-2026-80589,CVE-2026-80590,CVE-2026-80603,CVE-2026-80609,CVE-2026-80629,CVE-2026-80646,CVE-2026-80647,CVE-2026-80667,CVE-2026-80681,CVE-2026-80693,CVE-2026-80714,CVE-2026-80721,CVE-2026-80727,CVE-2026-80731,CVE-2026-80737,CVE-2026-80739,CVE-2026-80805,CVE-2026-80813,CVE-2026-80838
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
- CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
- CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
- CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).
- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).
- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).
- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).
- CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).
- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).
- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).
- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).
- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).
- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).
- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).
- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).
- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).
- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).
- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).
- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).
- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).
- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).
- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).
- CVE-2026-53341: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (bsc#1270139).
- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).
- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).
- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).
- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).
- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).
- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).
- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).
- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).
- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).
- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).
- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).
- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).
- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).
- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).
- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).
- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).
- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).
- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).
- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).
- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).
- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).
- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).
- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).
- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
- CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).
- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).
- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).
- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).
- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).
- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).
- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).
- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).
- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).
- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).
- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).
- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).
- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).
- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).
- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).
- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).
- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).
- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).
- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
- CVE-2026-64109: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (bsc#1273748).
- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).
- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).
- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).
- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).
- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).
- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).
- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).
- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).
- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).
- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).
- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).
- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).
- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).
- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).
- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).
- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).
- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).
- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).
- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).
- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
(bsc#1272799).
- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
- CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788).
- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).
- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).
- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).
- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).
- CVE-2026-64244: drivers/base/memory: set mem->altmap after successful device registration (bsc#1273812).
- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).
- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).
- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).
- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).
- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).
- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).
- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).
- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).
- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).
- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).
- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).
- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).
- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).
- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).
- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).
- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).
- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).
- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).
- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks (bsc#1273283).
- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).
- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).
- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).
- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).
- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).
- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).
- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).
- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).
- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).
- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).
- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).
- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).
- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).
- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).
- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).
- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).
- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).
- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).
- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).
- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).
- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).
- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).
- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).
- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).
- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).
- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).
- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).
- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).
- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).
- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).
- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).
- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
- CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).
- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).
- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).
- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).
- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).
- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).
- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).
- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).
- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).
- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).
- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).
- CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881).
- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).
- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).
- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).
- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).
- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).
- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).
- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).
- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).
- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).
- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).
- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).
- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).
- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).
- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).
- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).
- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).
- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).
- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).
- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).
- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).
- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
- CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305).
- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).
- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).
- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).
- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).
- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).
- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).
- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).
- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).
- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).
- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).
- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).
- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).
- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).
- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).
- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).
- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).
- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).
- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).
- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).
- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).
- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).
- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).
- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).
- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).
- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).
- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).
- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).
- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).
- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).
- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).
- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).
- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).
- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).
- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).
- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).
- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).
- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).
- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).
- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).
- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).
- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).
- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).
- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).
- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).
- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).
- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).
- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).
- CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).
- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).
- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).
- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).
- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).
- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).
- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).
- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).
- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).
- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).
- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).
- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).
- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).
- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).
- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).
- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).
- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).
- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).
- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).
- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).
- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).
- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).
- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).
- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).
- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).
- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).
- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).
- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).
- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
- CVE-2026-72234: batman-adv: access unicast_ttvn skb->data only after skb realloc (bsc#1275672).
- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).
- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).
- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).
- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).
- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).
- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).
- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).
- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).
- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).
- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).
- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).
- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).
- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).
- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).
- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
- CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660).
- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).
- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).
- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).
- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).
- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).
- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).
- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).
- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).
- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).
- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).
- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).
- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).
- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).
- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).
- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).
- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).
- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).
- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).
- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).
- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).
- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).
- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).
- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).
- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).
- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).
- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).
- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).
- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).
- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).
- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).
- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).
- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).
- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).
- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).
- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).
- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).
- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).
- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).
- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).
- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).
- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).
- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).
- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).
- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).
- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).
- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).
- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).
- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).
- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).
- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).
- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).
- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095).
- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).
- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).
- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).
- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).
- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).
- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).
- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).
- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).
- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).
- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).
- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).
- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).
- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).
- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).
- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).
- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).
- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).
- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).
- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).
- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).
- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).
- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).
- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).
- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).
- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).
- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).
- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).
- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).
- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).
- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).
- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).
- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).
- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).
- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).
- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).
- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).
- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).
- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).
- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).
- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).
- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).
- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
(bsc#1276572).
- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).
- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).
- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).
- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).
- CVE-2026-80531: xfs: avoid UAF on sc->tempip in xrep_tempfile_create (bsc#1277680).
- CVE-2026-80533: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair (bsc#1277636).
- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).
- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).
- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).
- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).
- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).
- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).
- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).
- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).
- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).
- CVE-2026-80609: qede: fix out-of-bounds check for cqe->len_list (bsc#1278334).
- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).
- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).
- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).
- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).
- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).
- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).
- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).
- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).
- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).
- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).
- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).
- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).
- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).
The following non security issues were fixed:
- accel/ivpu: Limit firmware log name prints to field size (git-fixes).
- accel/ivpu: Validate firmware log buffer metadata (git-fixes).
- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).
- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).
- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).
- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).
- ACPI: battery: Adjust charging status validation check (git-fixes).
- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).
- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).
- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).
- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).
- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).
- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).
- ACPI: video: Release PCI device reference after lookup (git-fixes).
- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).
- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).
- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).
- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).
- ALSA: caiaq: Fix potential double-free at error path (git-fixes).
- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).
- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).
- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).
- ALSA: dummy: Check card index validity at probe (stable-fixes).
- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).
- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).
- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).
- ALSA: hda: Fix connection list comparison in proc output (git-fixes).
- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).
- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).
- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).
- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).
- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).
- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).
- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).
- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).
- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).
- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).
- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).
- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).
- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).
- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).
- apparmor: advertise the tcp fast open fix is applied (git-fixes).
- ASoC: ab8500: Correct digital interface format setup (git-fixes).
- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).
- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).
- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).
- ASoC: adau1761: sort the register default table (git-fixes).
- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).
- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).
- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).
- ASoC: apple: mca: increase SERDES reset delay (git-fixes).
- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).
- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).
- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).
- ASoC: cs35l41: sort the register default table (git-fixes).
- ASoC: cs35l45: sort the register default table (git-fixes).
- ASoC: cs4265: sort the register default table (git-fixes).
- ASoC: cx2072x: sort the register default table (git-fixes).
- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).
- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).
- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).
- ASoC: fsl_easrc: sort the register default table (git-fixes).
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).
- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).
- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).
- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).
- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).
- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).
- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).
- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).
- ASoC: max9860: sort the register default table (git-fixes).
- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).
- ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses (git-fixes).
- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).
- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).
- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).
- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).
- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).
- ASoC: ml26124: sort the register default table (git-fixes).
- ASoC: mt6351: Publish the OF module alias (git-fixes).
- ASoC: pcm512x: sort the register default table (git-fixes).
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).
- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).
- ASoC: rt274: sort the register default table (git-fixes).
- ASoC: rt286: sort the register default table (git-fixes).
- ASoC: rt298: sort the register default table (git-fixes).
- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).
- ASoC: rt700: drop duplicate reg_default entry (git-fixes).
- ASoC: rt700: sort the register default table (git-fixes).
- ASoC: rt711-sdca: sort the register default tables (git-fixes).
- ASoC: rt711: sort the register default table (git-fixes).
- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).
- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).
- ASoC: rt715-sdca: sort the register default tables (git-fixes).
- ASoC: rt715: sort the register default table (git-fixes).
- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).
- ASoC: rt1316-sdw: sort the register default table (git-fixes).
- ASoC: rt1318-sdw: sort the register default table (git-fixes).
- ASoC: rt1318: sort the register default table (git-fixes).
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).
- ASoC: sgtl5000: sort the register default table (git-fixes).
- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).
- ASoC: SOF: validate topology volume range before allocation (git-fixes).
- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).
- ASoC: sti-sas: sort the register default table (git-fixes).
- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).
- ASoC: tas2552: sort the register default table (git-fixes).
- ASoC: tas2764: sort the register default table (git-fixes).
- ASoC: tas2780: sort the register default table (git-fixes).
- ASoC: tegra210_i2s: sort the register default table (git-fixes).
- ASoC: tegra210_mixer: sort the register default table (git-fixes).
- ASoC: tegra: Fix the MIXER enable default value (git-fixes).
- ASoC: tegra: Sort MBDRC register defaults (git-fixes).
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).
- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).
- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).
- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).
- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).
- batman-adv: fix stale receive device on merged fragments (git-fixes).
- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).
- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).
- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).
- blk-mq: reinsert cached request to the list (bsc#1273770).
- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).
- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).
- Bluetooth: btintel: validate version TLV value lengths (git-fixes).
- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).
- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).
- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).
- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).
- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).
- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).
- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).
- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).
- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).
- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).
- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).
- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).
- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).
- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).
- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).
- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).
- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).
- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).
- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).
- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).
- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).
- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).
- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).
- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).
- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).
- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).
- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).
- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).
- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).
- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).
- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).
- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).
- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).
- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).
- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).
- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).
- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).
- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).
- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).
- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).
- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).
- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).
- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).
- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).
- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).
- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).
- bnxt_en: Set bp->max_tpa according to what the FW supports (jsc#PED-16798).
- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).
- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).
- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).
- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).
- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).
- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).
- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).
- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).
- char: xilinx_hwicap: unregister class on init errors (git-fixes).
- cleanup: add a scoped version of CLASS() (stable-fixes).
- cleanup: fix scoped_class() (git-fixes).
- compiler_types: Introduce __flex_counter() and family (bsc#1280139).
- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).
- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).
- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).
- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).
- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).
- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).
- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).
- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).
- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).
- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).
- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).
- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).
- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).
- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).
- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).
- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).
- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).
- crypto: doc - Remove extra parenthesis (git-fixes).
- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).
- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).
- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).
- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).
- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).
- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).
- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).
- crypto: qat - clear AES key schedule from stack (git-fixes).
- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).
- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).
- crypto: qcom-rng - Allow zero as a random number (git-fixes).
- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).
- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).
- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).
- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (git-fixes).
- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).
- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).
- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).
- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).
- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).
- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).
- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).
- dmaengine: dw-edma: Serialize abort state updates (git-fixes).
- dmaengine: dw-edma: Serialize channel state checks (git-fixes).
- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).
- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).
- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).
- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).
- driver core: soc: Unregister bus on early device registration failure (git-fixes).
- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).
- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).
- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).
- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).
- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).
- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).
- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).
- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).
- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).
- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).
- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).
- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).
- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).
- drm/amd/pm: Use same metric table for APU (stable-fixes).
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).
- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).
- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).
- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).
- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).
- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).
- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).
- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).
- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).
- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).
- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).
- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).
- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).
- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).
- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).
- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (stable-fixes).
- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).
- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).
- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).
- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).
- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).
- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).
- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).
- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).
- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).
- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).
- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).
- drm/amdgpu: remove unused function parameter (stable-fixes).
- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).
- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).
- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).
- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).
- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).
- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).
- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).
- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).
- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).
- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).
- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).
- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).
- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).
- drm/gud: validate TV mode names before creating enum property (git-fixes).
- drm/hibmc: Fix list of formats on the primary plane (git-fixes).
- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).
- drm/i915/hdcp: check streams bounds before overflow (git-fixes).
- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).
- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).
- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).
- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).
- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).
- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).
- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).
- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).
- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).
- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).
- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).
- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).
- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).
- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).
- drm/nouveau: Use write-combined maps for coherent (git-fixes).
- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).
- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).
- drm/panthor: fix firmware control interface bounds checks (git-fixes).
- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).
- drm/panthor: skip zero-sized firmware sections (git-fixes).
- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).
- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).
- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).
- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).
- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).
- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).
- drm/sun4i: Drop node references while building component list (git-fixes).
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).
- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).
- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).
- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).
- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).
- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).
- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).
- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).
- drm/tve200: add OF module alias for autoloading (git-fixes).
- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).
- drm/xe/oa: Check managed mutex initialization errors (git-fixes).
- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).
- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).
- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).
- drm/xe: Order ring writes before ring tail updates (git-fixes).
- drm/xe: Stub out new pagefault layer (stable-fixes).
- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).
- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).
- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).
- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).
- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).
- erspan: Initialize options_len before referencing options (bsc#1274727).
- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).
- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).
- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).
- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).
- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).
- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).
- fbdev: vfb: defer cleanup until the last reference (git-fixes).
- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).
- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).
- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).
- firmware: arm_scmi: Fix requested device removal race (git-fixes).
- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).
- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).
- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).
- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).
- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).
- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).
- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).
- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).
- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).
- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).
- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).
- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).
- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).
- fpga: dfl: fme: add error handling (git-fixes).
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).
- fuse: fix race between interrupt and resend (git-fixes).
- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).
- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).
- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).
- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).
- HID: asus: fix missing hid_is_usb() check (git-fixes).
- HID: asus: simplify RGB init sequence (stable-fixes).
- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).
- HID: core: fix number/pointer type confusion on long items (git-fixes).
- HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes).
- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).
- HID: ft260: validate i2c input report length (stable-fixes).
- HID: hyperv: validate initial device info bounds (git-fixes).
- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes).
- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).
- HID: lg4ff: validate report length before fixed offsets (git-fixes).
- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).
- HID: magicmouse: do not keep a stale msc->input if no input is claimed (git-fixes).
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).
- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).
- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).
- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).
- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).
- HID: nintendo: register input device after capabilities are set (git-fixes).
- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).
- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).
- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).
- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).
- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).
- HID: roccat: bound device-supplied profile index (git-fixes).
- HID: roccat: free buffered reports when destroying device (git-fixes).
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).
- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).
- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).
- HID: synchronize input before cleaning up a failed probe (git-fixes).
- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).
- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).
- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).
- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).
- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).
- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).
- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).
- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).
- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).
- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes).
- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).
- hwmon: (ina2xx) Add support for INA234 (stable-fixes).
- hwmon: (ina2xx) Add support for INA260 (stable-fixes).
- hwmon: (ina2xx) Fix various overflow issues (git-fixes).
- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).
- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).
- hwmon: (ina226) Add support for SY24655 (stable-fixes).
- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).
- hwmon: (ltc4282) Clamp negative current limits (git-fixes).
- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).
- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).
- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).
- hwmon: (max6621) fix temperature clamp range (git-fixes).
- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).
- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).
- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).
- hwrng: omap - Fix probe error path cleanup (git-fixes).
- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).
- i2c: core: fix debugfs UAF on adapter removal (git-fixes).
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).
- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).
- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).
- i2c: ocores: Disable clock on failed resume (git-fixes).
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).
- i3c: dw: rename 'pclk' to 'apb' to match dt-binding (git-fixes).
- i3c: master: Fix device_register() error path (git-fixes).
- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).
- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).
- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).
- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).
- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).
- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).
- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).
- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).
- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).
- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).
- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).
- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).
- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).
- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).
- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).
- iio: light: cm32181: return zero after writing calibscale (git-fixes).
- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).
- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).
- iio: light: isl29028: return zero in write_raw() on success (git-fixes).
- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).
- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).
- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).
- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).
- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).
- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).
- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).
- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).
- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).
- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).
- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).
- Input: cs40l50-vibra - validate custom data from user space (git-fixes).
- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).
- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).
- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).
- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).
- Input: iforce - validate input packet lengths (stable-fixes).
- Input: iqs5xx - validate firmware record destination span (git-fixes).
- Input: mms114 - fix Y-resolution configuration (git-fixes).
- Input: psxpad-spi - set driver data before use (git-fixes).
- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).
- Input: sur40 - fix input device registration ordering (stable-fixes).
- Input: sur40 - fix V4L error path cleanup (stable-fixes).
- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).
- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).
- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).
- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).
- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).
- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).
- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).
- ipmi: ipmb: validate write message length (git-fixes).
- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).
- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).
- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).
- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).
- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).
- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).
- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).
- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).
- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).
- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).
- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).
- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).
- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).
- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).
- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).
- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).
- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).
- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).
- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).
- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).
- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).
- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).
- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).
- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).
- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).
- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).
- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).
- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).
- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).
- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).
- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).
- lib/string: fix memchr_inv() for large ranges (git-fixes).
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).
- mac802154: fix data race and NULL deref on local->assoc_dev (git-fixes).
- mac802154: fix netdev use-after-free in beacon worker (git-fixes).
- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).
- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).
- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).
- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).
- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).
- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).
- maple_tree: fix argument name in header (git-fixes).
- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).
- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).
- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).
- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).
- media: cec-pin: Fix event FIFO ordering (git-fixes).
- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).
- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).
- media: cec: Serialize exclusive follower delivery (git-fixes).
- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).
- media: cedrus: clean up media device on probe failure (git-fixes).
- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).
- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).
- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).
- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).
- media: cx231xx: fix devres lifetime (git-fixes).
- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).
- media: cx23885: add ioremap return check and cleanup (git-fixes).
- media: cx23885: cancel NetUP CI work before teardown (git-fixes).
- media: em28xx: defer audio-only extension registration (git-fixes).
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes).
- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).
- media: hevc: add bounded tile-count helpers (git-fixes).
- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).
- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).
- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).
- media: i2c: imx415: Return test pattern write errors (git-fixes).
- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).
- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).
- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).
- media: imx219: Fix maximum frame length in lines (git-fixes).
- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).
- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).
- media: ipu6: Do not free aux device pdata after init (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).
- media: mc-entity: Add missing kerneldoc (git-fixes).
- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).
- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).
- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).
- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).
- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).
- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).
- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).
- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).
- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).
- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).
- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).
- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).
- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).
- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).
- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).
- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).
- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).
- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).
- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).
- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).
- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).
- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).
- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).
- media: s2255: check firmware size before reading trailing marker (git-fixes).
- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).
- media: saa7164: fix cleanup on resource allocation failure (git-fixes).
- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).
- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).
- media: tda18250: fix possible integer overflow (git-fixes).
- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).
- media: usbtv: keep device alive while ALSA card exists (git-fixes).
- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).
- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).
- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).
- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).
- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).
- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).
- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).
- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).
- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).
- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).
- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).
- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).
- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).
- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).
- media: vivid: add vivid_update_reduced_fps() (git-fixes).
- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).
- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).
- media: zoran: Avoid freeing a registered video_device twice (git-fixes).
- mei: pull kvfree out of spinlock (git-fixes).
- mfd: iqs62x: Reject zero-length firmware records (git-fixes).
- mfd: rave-sp: validate received frame payload lengths (git-fixes).
- mfd: sm501: Fix potential memory leaks during remove (git-fixes).
- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).
- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).
- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes).
- misc: nsm: bound the device-reported response length (git-fixes).
- misc: rtsx: add missing write register handling (git-fixes).
- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).
- mkspec-dtb: Move DTS prefix into package list.
- mkspec-dtb: Move provides-obsoletes to package list.
- mkspec-dtb: Put per-architecture package lists into a hash.
- mkspec-dtb: re-indent.
- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).
- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).
- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).
- mtd: afs: validate v2 image info bounds (git-fixes).
- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).
- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).
- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).
- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).
- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).
- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).
- mtd: spinand: fix direct mapping creation sizes (stable-fixes).
- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).
- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).
- mtd: ubi: Release device reference on busy detach (git-fixes).
- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).
- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).
- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
- net: mana: Add handler for sriov configure (bsc#1272756).
- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).
- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).
- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).
- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).
- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).
- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).
- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).
- nfc: digital: Do not dump a NULL response in command completion (git-fixes).
- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).
- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).
- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes).
- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).
- nfc: microread: validate target discovery payload lengths (git-fixes).
- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).
- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).
- nfc: nci: free destination parameters when closing a connection (git-fixes).
- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).
- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).
- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).
- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).
- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).
- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).
- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).
- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).
- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).
- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).
- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).
- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).
- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).
- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).
- perf: Reject exited events as group leaders (git-fixes).
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).
- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).
- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).
- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).
- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).
- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).
- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).
- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).
- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).
- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).
- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).
- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).
- platform/x86: dell-privacy: Fix race condition (git-fixes).
- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).
- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).
- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).
- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).
- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).
- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).
- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).
- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).
- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).
- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).
- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).
- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).
- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).
- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).
- platform/x86: ISST: Return error during profile addition (git-fixes).
- platform/x86: ISST: Use PP level enable mask (git-fixes).
- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).
- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).
- platform/x86: ISST: Validate parameter for core power state (git-fixes).
- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).
- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).
- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).
- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).
- power: supply: bd99954: Drop bad register fields (git-fixes).
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).
- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).
- power: supply: bq24257: fix use-after-free on remove (git-fixes).
- power: supply: bq25890: Fix power_supply reference leak (git-fixes).
- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).
- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).
- power: supply: isp1704_charger: cancel work on remove (git-fixes).
- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).
- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).
- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).
- power: supply: max17040: propagate register read errors (git-fixes).
- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).
- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).
- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).
- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).
- power: supply: sc2731_charger: cancel work on remove (git-fixes).
- power: supply: twl4030_charger: cancel workers via devm (git-fixes).
- power: supply: ucs1002: fix use-after-free on remove (git-fixes).
- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).
- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).
- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).
- powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256).
- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752
ltc#221290).
- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).
- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).
- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).
- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).
- ppdev: prevent overflow when setting port timeout (git-fixes).
- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).
- rapidio: clear mport->net when rio_add_net() fails (git-fixes).
- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).
- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).
- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).
- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).
- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
- RDMA/mana_ib: unify QP lookup table (git-fixes).
- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).
- regulator: core: use system_freezable_wq for init complete work (git-fixes).
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).
- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes).
- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).
- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).
- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).
- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).
- Revert 'net: thunderbolt: Enable end-to-end flow control also in transmit' (git-fixes).
- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).
- Revert 'wifi: mt76: Disable napi when removing device' (git-fixes).
- rpmsg: core: Fix incorrect return value documentation (git-fixes).
- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).
- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).
- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).
- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).
- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).
- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).
- rtc: zynqmp: Return optional clock lookup errors (git-fixes).
- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).
- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).
- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).
- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).
- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).
- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).
- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).
- scsi: fnic: Bump up version number (bsc#1236344).
- scsi: fnic: Decode firmware role configuration (bsc#1236344).
- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).
- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).
- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).
- scsi: fnic: Make debug logging protocol independent (bsc#1236344).
- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).
- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).
- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).
- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).
- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).
- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).
- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).
- scsi: fnic: Switch to use %ptSp (bsc#1236344).
- scsi: fnic: Track NVMe transport statistics (bsc#1236344).
- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).
- scsi: fnic: Use mempool for receive frames (bsc#1236344).
- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).
- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).
- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).
- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).
- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).
- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).
- serial: amba-pl011: unprepare console clock on unregister (git-fixes).
- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).
- serial: imx: serialize imx_uart_ports lifetime (git-fixes).
- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).
- serial: qcom-geni: do not advance stale DMA completions (git-fixes).
- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).
- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).
- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).
- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).
- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
- slab: Introduce kmalloc_flex() and family (bsc#1280139).
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
- smb: client: harden POSIX SID length parsing (bsc#1273557).
- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).
- smb: client: resolve SWN tcon from live registrations (bsc#1273872).
- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).
- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).
- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).
- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).
- spi: bcm63xx: disable clock on resume failure (git-fixes).
- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).
- spi: davinci: switch to managed controller allocation (git-fixes).
- spi: Fix DMA mapping ownership on partial map failure (git-fixes).
- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).
- spi: oc-tiny: switch to managed controller allocation (git-fixes).
- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).
- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).
- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).
- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).
- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).
- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).
- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).
- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).
- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).
- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).
- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).
- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).
- staging: sm750fb: Add missing Kconfig dependency (git-fixes).
- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).
- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).
- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).
- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).
- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).
- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes).
- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).
- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).
- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).
- tpm: st33zp24: Return zero on status read failure (git-fixes).
- tpm: st33zp24: Validate locality read result (git-fixes).
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).
- tty: clear cdev pointer after cdev_add() failure (git-fixes).
- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).
- tty: skip cdev_del() when no cdev is registered (git-fixes).
- uio: Fix stale info pointer in failed registration path (git-fixes).
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).
- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).
- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).
- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).
- usb: core: Add lock to usb_wakeup_notification() (git-fixes).
- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).
- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).
- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).
- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).
- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).
- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).
- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).
- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).
- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).
- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).
- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).
- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).
- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).
- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).
- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).
- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).
- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).
- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).
- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).
- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).
- usb: gadget: uac: validate rate list length before storing (git-fixes).
- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).
- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).
- usb: mtu3: allow system suspend during active gadget connection (git-fixes).
- usb: musb: omap2430: clean up probe error handling (stable-fixes).
- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).
- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).
- USB: phy: fsl-usb: fix missing static keywords (git-fixes).
- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).
- USB: serial: digi_acceleport: fix port registration order (git-fixes).
- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).
- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).
- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).
- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).
- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).
- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).
- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).
- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).
- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).
- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).
- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).
- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).
- usb: usbtest: disable dynamic ID support (stable-fixes).
- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).
- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).
- vt: add permission check for KDSKBMETA ioctl (stable-fixes).
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).
- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).
- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).
- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).
- watchdog: msc313e: Avoid division by zero (git-fixes).
- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).
- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).
- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).
- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).
- watchdog: msc313e: Fix undefined behavior (git-fixes).
- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).
- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).
- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).
- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).
- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).
- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).
- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).
- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).
- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).
- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).
- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).
- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).
- wifi: cfg80211: validate PMSR measurement type data (git-fixes).
- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).
- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).
- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).
- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).
- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).
- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).
- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).
- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).
- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).
- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).
- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).
- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).
- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).
- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).
- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).
- wifi: mt76: check txfree done event on the WED hw path (git-fixes).
- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).
- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).
- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).
- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).
- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).
- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).
- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).
- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).
- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).
- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).
- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).
- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).
- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).
- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).
- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).
- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).
- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).
- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).
- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).
- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).
- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).
- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).
- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).
- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).
- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).
- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).
- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).
- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).
- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).
- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).
- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).
- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).
- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).
- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).
- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).
- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).
- wifi: rtw89: fix HE extended capability length check (git-fixes).
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).
- x86/virt/tdx: Print TDX module version during init (git-fixes).
- x86/virt/tdx: Retrieve TDX module version (git-fixes).
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).
- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).
- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).
The following package changes have been done:
- libuuid1-2.41.1-160000.5.1 updated
- libsmartcols1-2.41.1-160000.5.1 updated
- liblastlog2-2-2.41.1-160000.5.1 updated
- libblkid1-2.41.1-160000.5.1 updated
- libmount1-2.41.1-160000.5.1 updated
- libfdisk1-2.41.1-160000.5.1 updated
- util-linux-2.41.1-160000.5.1 updated
- util-linux-systemd-2.41.1-160000.5.1 updated
- kernel-default-base-6.12.0-160000.38.1.160000.2.24 updated
- container:suse-sl-micro-6.2-base-os-container-latest-b418d673df310746ae418b83e1018dbff86b101a3ce3219953a070a6b628fe18-0 updated
More information about the sle-container-updates
mailing list